Description
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Eventin | < 4.1.19 | 4.1.19 |
References
- https://wpscan.com/vulnerability/2670eac4-b630-4546-9b56-f19feabfa550/ exploit vdb-entry technical-description