Executive brief
Eventin is a WordPress plugin for managing event ticketing and bookings with payment processing. The plugin fails to verify that completed payments belong to the correct order, allowing attackers to replay a single low-value legitimate payment to mark any unpaid order as paid—effectively enabling fraudulent ticket purchases or event registrations at no cost.
Technical details
The vulnerability is a payment verification bypass in the Eventin plugin (before version 4.1.24). The plugin accepts payment confirmation from Stripe and PayPal gateways but does not validate that the payment amount, currency, or order ID matches the order being fulfilled. An unauthenticated attacker can replay a legitimate low-value transaction token against any target order, causing the payment gateway to report success for an unrelated transaction. This allows arbitrary orders to be marked as paid without receiving actual funds. The attack requires network access to the payment confirmation endpoint but no authentication or user interaction beyond the initial crafted request.
Affected products
- Eventin Eventin before 4.1.24
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in version 4.1.24