CVE-2026-77702: Eventin WordPress Plugin Auth Bypass Flaw

CVE-2026-77702 Overview

CVE-2026-77702 is a missing authorization vulnerability [CWE-862] in the Eventin WordPress plugin versions before 4.1.24. The plugin issues a guest token at checkout but fails to restrict its scope after the order is placed. An unauthenticated attacker can reuse that token to modify the associated order and swap a paid ticket for a free one. The order then completes at no cost, resulting in fraudulent ticket acquisition.

Critical Impact
Unauthenticated attackers can obtain paid event tickets for free by replacing purchased tickets after checkout, causing direct revenue loss to event organizers using the Eventin plugin.

Affected Products

Eventin WordPress plugin versions prior to 4.1.24
WordPress sites selling event tickets through Eventin
Event organizers relying on Eventin guest checkout flow

Discovery Timeline

2026-09-16 - CVE-2026-77702 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-77702

Vulnerability Analysis

The Eventin plugin supports guest checkout by issuing a token bound to the buyer's order. This token allows the guest to view or manage their order without a registered account. The plugin does not invalidate or scope-restrict the token after payment, so it remains valid for order modification requests.

An unauthenticated attacker who obtains the token, either as the original guest or through interception during checkout, can submit a ticket change request against the completed order. The plugin accepts the change without re-verifying payment state, allowing substitution of a paid ticket with a free ticket variant. The order recalculates to zero cost while the ticket entitlement remains.

The flaw is categorized under Common Weakness Enumeration [CWE-862] Missing Authorization. It represents a business logic failure where the authorization check verifies token possession but not the permitted actions for the order's current lifecycle stage.

Root Cause

The root cause is the absence of a state-aware authorization check on the order modification endpoint. The token granted at checkout is treated as a general-purpose credential for the order rather than a scoped credential limited to pre-payment operations. The plugin does not enforce immutability of ticket selection after the order transitions to a paid state.

Attack Vector

The attack requires network access to the target WordPress site running a vulnerable Eventin version. An attacker initiates a guest checkout, obtains the token, and completes payment for a paid ticket. They then replay the token against the ticket modification endpoint to change the selection to a free ticket. Refer to the WPScan Vulnerability Advisory for technical details on the request flow.

Detection Methods for CVE-2026-77702

Indicators of Compromise

Completed orders in Eventin showing a total of zero that were originally initiated for paid tickets
Ticket change events on orders that occur after a successful payment webhook
Repeated guest checkout attempts from the same IP address followed by ticket downgrades
Discrepancies between payment gateway records and Eventin order totals

Detection Strategies

Audit the Eventin order log for orders whose ticket type changed after the payment confirmation timestamp
Compare payment processor transaction records against issued tickets to identify unpaid entitlements
Monitor WordPress access logs for POST requests to Eventin ticket update endpoints containing guest tokens after checkout completion
Alert on orders that transition from a non-zero total to a zero total after order creation

Monitoring Recommendations

Enable verbose logging on the Eventin plugin to capture order state transitions and token usage
Forward WordPress and web server logs to a centralized platform for correlation with payment gateway events
Track outbound webhook mismatches between payment providers and the WordPress site

How to Mitigate CVE-2026-77702

Immediate Actions Required

Update the Eventin WordPress plugin to version 4.1.24 or later on all affected sites
Review order history since the plugin was installed to identify fraudulent free-ticket conversions
Reconcile ticket entitlements against payment processor records and revoke tickets that were not paid for
Restrict guest checkout temporarily if immediate patching is not possible

Patch Information

The vendor addressed CVE-2026-77702 in Eventin version 4.1.24. The fix restricts the guest checkout token so it cannot be used to modify tickets on an order that has already been completed. Administrators should verify the installed version through the WordPress plugin dashboard and apply automatic updates where feasible. See the WPScan Vulnerability Advisory for the authoritative reference.

Workarounds

Disable guest checkout in Eventin settings and require account registration for ticket purchases
Add a Web Application Firewall (WAF) rule blocking POST requests to Eventin ticket modification endpoints that carry a guest token after payment completion
Implement server-side reconciliation between the payment gateway and Eventin order totals on a scheduled basis

bash

# Verify installed Eventin version via WP-CLI
wp plugin get wp-event-solution --field=version

# Update Eventin to the patched release
wp plugin update wp-event-solution --version=4.1.24