PT-2026-93285

CVE-2026-77702

Published

2026-09-16

Updated

2026-09-16

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Eventin WordPress plugin versions prior to 4.1.24

Description An issue exists where the plugin fails to prevent a token issued to a guest during checkout from being reused to modify the order tickets. This allows unauthenticated users to replace a paid ticket with a free one, enabling them to complete the order without payment.

Recommendations Update Eventin WordPress plugin to version 4.1.24 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Nir Yehoshua

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers