CVE-2026-84906

Name of the Vulnerable Software and Affected Versions Eventin WordPress plugin versions prior to 4.1.24

Description An issue exists where the software fails to verify if a completed payment corresponds to the specific order it is applied to. The system only confirms that the payment gateway reports a successful transaction, without validating the amount, currency, or the associated order. This allows unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.

Recommendations Update Eventin WordPress plugin to version 4.1.24 or later.