Eventin lets guest checkout tokens be reused to avoid ticket payment
Eventin before 4.1.24: An unauthenticated guest can reuse the token issued during checkout to alter the order's tickets afterward. The token permits replacement of a paid ticket with a free one followed by completion at no charge. The export does not name the mutation endpoint, token field or finalization function.
- Component
- Eventin
- Plugin slug
wp-event-solution- Affected
- < 4.1.24
- Safe version
4.1.24- Published
- Sep 16, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Sep 16, 2026 and is one of 45 known issues for this plugin.
Update, patch or deactivate.
Update Eventin to 4.1.24 or later. Bind checkout authorization to immutable order contents, revalidate tickets and price on every change, and invalidate or reissue tokens when the order changes. Reconcile completed orders against the tickets and amounts actually authorized.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N