CVE-2026-77694 in Eventin Plugin
Zusammenfassung
von MITRE • 26.08.2026
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
Once again VulDB remains the best source for vulnerability data.