CVE-2026-77702: CWE-862 Missing Authorization in Eventin
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
AI Analysis
Technical Summary
CVE-2026-77702 is a missing authorization vulnerability (CWE-862) in the Eventin WordPress plugin before version 4.1.24. The plugin does not properly restrict the use of a token issued to guests during checkout, enabling unauthorized users to alter their order's tickets post-checkout. This can be exploited to swap paid tickets for free tickets and finalize the order without charge.
Potential Impact
An attacker can bypass payment by manipulating order tickets using a guest token, resulting in unauthorized free access to paid events. This undermines the revenue model of the affected plugin users and can lead to financial loss.
Mitigation Recommendations
Upgrade the Eventin plugin to version 4.1.24 or later, where this authorization issue has been addressed. No other mitigation is indicated.
CVE-2026-77702: CWE-862 Missing Authorization in Eventin
Description
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
Affected software
Eventin
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-77702 is a missing authorization vulnerability (CWE-862) in the Eventin WordPress plugin before version 4.1.24. The plugin does not properly restrict the use of a token issued to guests during checkout, enabling unauthorized users to alter their order's tickets post-checkout. This can be exploited to swap paid tickets for free tickets and finalize the order without charge.
Potential Impact
An attacker can bypass payment by manipulating order tickets using a guest token, resulting in unauthorized free access to paid events. This undermines the revenue model of the affected plugin users and can lead to financial loss.
Mitigation Recommendations
Upgrade the Eventin plugin to version 4.1.24 or later, where this authorization issue has been addressed. No other mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-21T08:01:16.246Z
- State
- PUBLISHED
Threat ID: 6aaa32e055bf5e2cf517fb28
Added to database: 09/16/2026, 06:10:40 UTC
Last enriched: 09/16/2026, 06:32:14 UTC
Last updated: 09/16/2026, 22:11:12 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.