Executive brief
Eventin is a WordPress plugin for managing paid events and ticketing. An unauthenticated attacker can bypass payment authorization by manipulating a guest checkout token, allowing them to mark unpaid orders as completed and receive valid paid tickets without making any payment. This directly impacts event revenue and can be exploited repeatedly to issue free tickets to paid events.
Technical details
The vulnerability is an authorization bypass (CWE-862) in the Eventin plugin's REST API order handling. The OrderController::update_item endpoint accepts the "update_booking_status" action on guest orders when called with only the order_access_token parameter, without verifying owner or staff capabilities. An unauthenticated attacker can: (1) create a guest order for a paid ticket via POST to /wp-json/eventin/v2/orders, receiving an order_access_token; (2) change the order status to "completed" via PUT to /wp-json/eventin/v2/orders/ORDER_ID with the token, bypassing payment validation. The fix in version 4.1.19 explicitly rejects update_booking_status actions on the token-based endpoint.
Affected products
- Web Ying Eventin before 4.1.19
Timeline
- 2026-08-24: disclosed
- 2026-08-26: patched: Fixed in version 4.1.19