Executive brief
The Eventin WordPress plugin for event ticketing fails to properly validate guest checkout tokens, allowing unauthenticated users to modify order details after payment. An attacker can swap a paid ticket for a free one and complete the purchase at no cost, directly impacting revenue and inventory controls.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the Eventin plugin's order modification endpoint. When a guest completes checkout, the system issues an order_token for that transaction; however, the plugin does not validate that subsequent requests to modify tickets are authorized by the legitimate order owner. An unauthenticated attacker can use a known or guessed order_token to change ticket selections, replacing paid tickets with free alternatives and completing the order without payment. The issue affects versions before 4.1.24 and is network-reachable with no authentication or user interaction required beyond obtaining a valid token. A patch is available in version 4.1.24.
Affected products
- WebAppick Eventin before 4.1.24
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in version 4.1.24
- 2026-09-16: advisory