CVE-2026-77694 Overview
CVE-2026-77694 is a missing authorization vulnerability [CWE-862] in the Eventin WordPress plugin versions before 4.1.19. The plugin fails to properly restrict the actions a guest checkout token can authorize on an order. Unauthenticated users can mark their own unpaid order as completed and receive a valid paid ticket without any payment being processed. The flaw enables free acquisition of event tickets that otherwise require payment.
Critical Impact
Unauthenticated attackers can obtain paid event tickets without payment by manipulating guest checkout order status through the plugin's token-based authorization flow.
Affected Products
- Eventin WordPress plugin versions prior to 4.1.19
Discovery Timeline
- 2026-08-26 - CVE-2026-77694 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-77694
Vulnerability Analysis
The Eventin plugin supports guest checkout, issuing a token that lets unauthenticated purchasers interact with their own order. The token grants access to legitimate customer actions such as viewing order details. However, the plugin does not enforce a proper allow-list for which state transitions the token can authorize on an order.
As a result, the token can be replayed to invoke order-status changes reserved for administrative or payment-gateway callbacks. An attacker completes a normal guest checkout, obtains the token, and then uses it to transition the order from pending to completed. The plugin issues a paid ticket in response to the completion event, treating the transition as if payment had been captured.
Root Cause
The root cause is a missing authorization check [CWE-862] on order-mutation endpoints reachable with the guest checkout token. The plugin conflates possession of the token with authorization to change payment-relevant state. Read scope and write scope are not separated, and the completion action is not restricted to authenticated gateway or admin contexts.
Attack Vector
Exploitation is network-based, requires no authentication, and no user interaction. An attacker initiates a guest checkout on a vulnerable site, captures the returned token, then issues a request that flips order status to completed. The plugin generates a valid ticket bound to the order without confirming payment settlement. Technical specifics are documented in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-77694
Indicators of Compromise
- Orders transitioning from pending or unpaid status to completed without a corresponding successful transaction in the payment gateway logs.
- Issued tickets tied to orders that show a zero or missing gateway transaction identifier.
- Guest checkout sessions where the same token generates both a checkout request and an order-completion request within a short window.
Detection Strategies
- Reconcile WordPress and Eventin order records against payment processor settlements to identify tickets issued without matching charges.
- Inspect web server access logs for unauthenticated POST requests to Eventin order endpoints that include a guest token and modify order status.
- Alert on rapid sequences of guest checkout creation followed by status change requests from the same IP address.
Monitoring Recommendations
- Enable audit logging on the WordPress site to record order status changes, the actor performing them, and the source IP.
- Forward web and application logs to a centralized analytics platform for correlation with payment gateway events.
- Monitor ticket issuance volume for anomalies that deviate from historical baselines.
How to Mitigate CVE-2026-77694
Immediate Actions Required
- Update the Eventin plugin to version 4.1.19 or later on all affected WordPress sites.
- Audit orders and issued tickets since the plugin was installed to identify fraudulently completed orders.
- Revoke tickets that cannot be matched to a settled payment gateway transaction.
Patch Information
The vendor addressed CVE-2026-77694 in Eventin version 4.1.19. The fix restricts the actions a guest checkout token can authorize so that unauthenticated users cannot mark orders as completed. Details are available in the WPScan Vulnerability Report.
Workarounds
- Disable guest checkout in Eventin and require account registration until the plugin is updated.
- Deploy a web application firewall rule that blocks unauthenticated requests attempting to change Eventin order status.
- Temporarily disable the Eventin plugin on sites where ticket sales are not actively required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
