Description

The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-26T06:16:29.313Z",
  "pubdate": "2026-08-26T06:16:29.313Z",
  "executiveSummary": "The Eventin WordPress plugin is vulnerable to an authorization bypass flaw that enables unauthenticated attackers to manipulate order statuses.\nSpecifically, the vulnerability resides in the handling of guest checkout tokens, which fail to enforce strict server-side validation regarding the authorized scope of modifications.\nThis security weakness allows a remote, unauthenticated attacker to programmatically transition an unpaid order to a 'completed' status without interacting with a payment gateway.\nThe primary impact is the unauthorized acquisition of valid, paid tickets, leading to potential financial loss and service abuse.\nThis vulnerability affects all Eventin versions prior to 4.1.19. The risk is considered critical, as the exploit requires no specific privileges and can be executed over the network by any individual possessing an order token.\nSuccessful exploitation bypasses the core commerce logic of the plugin, rendering payment verification controls ineffective.",
  "technicalDetails": "The root cause of this vulnerability is an Insecure Direct Object Reference (IDOR) combined with insufficient server-side authorization checks within the Eventin guest checkout flow.\nIn versions prior to 4.1.19, the plugin utilizes guest checkout tokens to facilitate order management for users without registered accounts. However, the logic governing the processing of requests associated with these tokens fails to perform adequate validation of the order's state or the intended transition requested by the client.\nThe vulnerability manifests during the order fulfillment process. When a guest initiates an order, the system generates a unique token intended to track the transaction. An attacker can intercept or infer the structure of the request used to update an order's status.\nExploitation occurs through the following attack flow: 1. An attacker initiates a legitimate order process within the plugin but stops before payment execution. 2. The attacker obtains the guest checkout token associated with this unpaid order. 3. The attacker constructs a malicious HTTP request targeting the plugin's internal order processing functions, passing the guest token and injecting a parameter or action that indicates the order should be transitioned to 'completed' or 'paid'.\nBecause the vulnerable component does not verify whether the order has received confirmation from an integrated payment provider (such as Stripe or PayPal) before processing the status change, the application incorrectly flags the order as successful. Consequently, the system triggers the internal post-payment routines, including the generation and delivery of valid ticket assets to the user.\nThis lack of authorization allows an attacker to bypass all financial gatekeepers. The component responsible for updating the order status fails to implement a secondary integrity check against the order's payment metadata, treating the user-provided request as trusted input. The result is a critical authorization bypass where the attacker secures digital assets without valid financial settlement.\nThe flaw is exposed to the public internet, requiring no authentication or specific user privileges. The post-exploitation impact allows for the mass generation of tickets, which can disrupt venue management and result in significant revenue leakage for site operators utilizing the Eventin plugin for ticketing."
}