Executive brief
Eventin is a popular WordPress plugin for managing events and ticket sales. The plugin's offline payment method contains a vulnerability that allows unauthenticated attackers to reset any order and its associated attendees to a pending state, invalidating paid tickets. This could result in customers losing access to events they have already purchased and requiring manual intervention to restore orders.
Technical details
The vulnerability is a missing authorization flaw (CWE-862) in the order finalization REST endpoint when offline payment method is enabled. The plugin relies on a nonce that is exposed to unauthenticated visitors and fails to verify that the requesting user owns the order being modified. Attackers can make unauthenticated requests to reset any existing order and its attendees to pending status without authentication or user interaction. The vulnerability has been patched in version 4.1.24, and proof-of-concept details are scheduled to be disclosed on September 28, 2026.
Affected products
- Eventin Eventin before 4.1.24
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in version 4.1.24