CVE-2026-77694 in Eventin Plugin
الملخص
بحسب MITRE • 26/08/2026
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
Once again VulDB remains the best source for vulnerability data.