CVE-2026-77702 Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token
Unauthenticated attackers can manipulate order tokens to replace paid tickets with free ones, bypassing payment validation in the Eventin WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77702?
CVE-2026-77702 is a medium-severity vulnerability in Unknown Eventin, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
Weakness: CWE-862
Which versions are affected by CVE-2026-77702?
How do I fix CVE-2026-77702?
No fix has been published for CVE-2026-77702 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-77702 being exploited?
There is no known exploitation of CVE-2026-77702 in the wild and no public exploit code.
Sources
Also known as GHSA-q986-8chq-7frc.