CVE-2026-77702 - Vulnerability Details - OpenCVE

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Eventin	Eventin
Wordpress	Wordpress

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/a4fa75f7-2b30-4659-9e25-dd3454c50ebb/

History

Fri, 18 Sep 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-284

Thu, 17 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-862
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 16 Sep 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284

Wed, 16 Sep 2026 10:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Eventin Eventin eventin Wordpress Wordpress wordpress
Vendors & Products		Eventin Eventin eventin Wordpress Wordpress wordpress

Wed, 16 Sep 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
Title		Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token
References		https://wpscan.com/vulnerability/a4fa75f7-2b30-4659-9e25-dd3454c50ebb/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-09-16T06:00:11.967Z

Updated: 2026-09-17T12:39:24.565Z

Reserved: 2026-08-21T08:01:16.246Z

Link: CVE-2026-77702

Vulnrichment

Updated: 2026-09-17T12:21:00.550Z

NVD

Status : Deferred

Published: 2026-09-16T06:16:32.727

Modified: 2026-09-17T13:16:47.130

Link: CVE-2026-77702

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77702", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-08-21T08:01:16.246Z", "datePublished": "2026-09-16T06:00:11.967Z", "dateUpdated": "2026-09-17T12:39:24.565Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-16T06:00:11.967Z"}, "title": "Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token", "problemTypes": [{"descriptions": [{"description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Eventin", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "4.1.24"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge."}], "references": [{"url": "https://wpscan.com/vulnerability/a4fa75f7-2b30-4659-9e25-dd3454c50ebb/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Nir Yehoshua", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-17T12:21:17.114157Z", "id": "CVE-2026-77702", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T12:39:24.565Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Nir Yehoshua"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Eventin", "versions": [{"status": "affected", "version": "0", "lessThan": "4.1.24", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/a4fa75f7-2b30-4659-9e25-dd3454c50ebb/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-16T06:00:11.967Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-77702", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T12:21:17.114157Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-09-17T12:21:00.550Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-77702", "state": "PUBLISHED", "dateUpdated": "2026-09-16T06:00:11.967Z", "dateReserved": "2026-08-21T08:01:16.246Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2026-09-16T06:00:11.967Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}