CVE-2026-84907 Overview
CVE-2026-84907 affects the Eventin WordPress plugin in versions before 4.1.24. The plugin fails to properly authorise order finalisation when the offline (local) payment method is enabled. It relies on a nonce that is exposed to unauthenticated visitors and never verifies that the caller owns the target order. Unauthenticated attackers can reset any existing order and its attendees to a pending state, invalidating paid tickets. The flaw is classified as Missing Authorization [CWE-862].
Critical Impact
Unauthenticated attackers can reset arbitrary paid orders to pending, invalidating tickets and disrupting event attendance workflows.
Affected Products
- Eventin WordPress plugin versions prior to 4.1.24
- WordPress sites with the Eventin offline (local) payment method enabled
- Event ticketing workflows that depend on Eventin order state
Discovery Timeline
- 2026-09-16 - CVE-2026-84907 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-84907
Vulnerability Analysis
The Eventin plugin exposes an order finalisation endpoint intended for the offline payment workflow. The endpoint is protected only by a WordPress nonce that is rendered on pages accessible to unauthenticated visitors. Because the nonce is retrievable without authentication, it does not function as an authorisation control in this context.
The endpoint additionally omits a check that the caller is the owner of the referenced order. An attacker who supplies a valid order identifier can therefore trigger a state transition on any order in the system. The result is that paid orders and their associated attendees are reverted to a pending state, invalidating previously issued tickets.
Root Cause
The root cause is missing authorization [CWE-862] on a state-changing endpoint. The plugin conflates request authenticity (nonce presence) with request authorisation (ownership of the order). Because the nonce is publicly reachable and no per-order ownership check is performed, any unauthenticated request that supplies a valid order ID succeeds.
Attack Vector
The attack is network-based and requires no authentication or user interaction. An attacker retrieves the public nonce from a page rendered by the plugin. The attacker then submits a request to the offline payment finalisation endpoint referencing an arbitrary order identifier. The targeted order and its attendees are reset to pending, invalidating the ticket. Attack complexity is elevated because the attacker must enumerate or obtain valid order identifiers.
No verified public exploit code is available. See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-84907
Indicators of Compromise
- Unexpected transitions of Eventin orders from a paid or completed state back to pending.
- Attendee records associated with paid orders showing invalidated or reissued ticket status.
- HTTP POST requests to Eventin offline payment finalisation endpoints originating from unauthenticated sessions.
- Bursts of requests iterating sequential order identifiers against the plugin's AJAX or REST endpoints.
Detection Strategies
- Audit WordPress database changes to Eventin order and attendee tables for status downgrades that lack a corresponding administrative action.
- Correlate web server access logs with plugin actions to identify unauthenticated callers reaching order finalisation endpoints.
- Alert on Eventin plugin versions below 4.1.24 discovered during asset inventory scans.
Monitoring Recommendations
- Enable verbose logging on the WordPress instance and forward events to a central SIEM for correlation.
- Track order state changes over time and flag reversions from paid to pending as high-signal events.
- Monitor for repeated 200 OK responses to unauthenticated POSTs against /wp-admin/admin-ajax.php or Eventin REST routes.
How to Mitigate CVE-2026-84907
Immediate Actions Required
- Upgrade the Eventin plugin to version 4.1.24 or later on all WordPress instances.
- Inventory sites using Eventin and confirm whether the offline (local) payment method is enabled.
- Review recent Eventin orders and attendee records for unexpected reversions to pending state.
Patch Information
The vendor addresses the issue in Eventin version 4.1.24. The fix introduces an ownership check on the order finalisation flow so that requests without a legitimate association to the referenced order are rejected. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the offline (local) payment method in Eventin settings until the plugin is upgraded.
- Restrict access to the site's admin-ajax.php and Eventin REST endpoints using web application firewall rules that require authenticated sessions for order state changes.
- Temporarily deactivate the Eventin plugin on sites where upgrading is not immediately feasible and event ticketing is not actively in use.
# Configuration example: verify installed Eventin version via WP-CLI
wp plugin get wp-event-solution --field=version
# Upgrade Eventin to the fixed release
wp plugin update wp-event-solution --version=4.1.24
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
