CVE-2026-77702

CVE-2026-77702 affects the Eventin WordPress plugin in versions before 4.1.24 . The root cause is that a token issued to a guest at checkout (specifically via the order_token mechanism) is not invalidated afterwards, allowing unauthenticated users to return and modify that order's tickets. The pr...

CVE-2026-77694

Eventin (also known as WP Event Solution ) WordPress plugin versions below 4.1.19 contain an unauthenticated order-completion vulnerability . The root cause is improper restriction of which changes a guest checkout token is allowed to authorise on an order. An unauthenticated user can mark their ...