Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token

Description

The plugin does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.