WordPress Eventin plugin < 4.1.24 - Unauthenticated Ticket Price Rewrite vulnerability

Unauthenticated Ticket Price Rewrite vulnerability discovered by Nir Yehoshua in WordPress Plugin WP Event Solution versions 4.1.24...

CVE-2026-77702 Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...

CVE-2026-77702

The Eventin WordPress plugin (also known as WP Event Solution ) versions prior to 4.1.24 is vulnerable to an unauthenticated ticket price rewrite. The flaw exists because the plugin fails to prevent a guest's checkout token from being used to modify order tickets post-checkout. This allows an una...

Multiplier must be capped to prevent expected payout exceeding ticket price

Lines of code Vulnerability details Impact Expected payout may be greater than ticket price, bankrupting the lottery. Proof of Concept ticketsSold determines the multiplier to be used when calculating non jackpot rewards LotteryMath.solL84: bonusMulti += excessPot EXCESSBONUSALLOCATION /...