Detections
Analytics
CVE-2026-77694
medium
Description
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
References
https://wpscan.com/vulnerability/2670eac4-b630-4546-9b56-f19feabfa550/