Eventin accepts replayed low-value payments for unrelated unpaid orders
Eventin before 4.1.24 checks that a gateway transaction succeeded but does not bind it to the order being marked paid or verify the amount and currency. An unauthenticated visitor who has made a genuine low-value payment can replay that transaction against unrelated unpaid orders of any value. The export does not name the payment gateway, callback, transaction field or order-selection parameter. A real successful payment is a prerequisite; this is not payment creation from nothing.
- Component
- Eventin
- Plugin slug
wp-event-solution- Affected
- < 4.1.24
- Safe version
4.1.24- Published
- Sep 16, 2026
This CVE was published Sep 16, 2026 and is one of 45 known issues for this plugin.
Update, patch or deactivate.
Update Eventin to 4.1.24 or later. Verify the transaction's order binding, expected amount and currency with the gateway before changing payment state. Record each transaction's consumption atomically to prevent replay across orders, and reconcile affected paid orders against gateway receipts.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N