Security Advisory

CVE-2026-77702

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-16 06:00:11

Last updated 2026-09-17 12:39:24

Assigner WPScan

CVSS score 5.3

State PUBLISHED

Description

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.

← Browse all CVEs View on cve.org ↗