UNKNOWN NVD

CVE-2026-77702

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards,

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.

References

https://wpscan.com/vulnerability/a4fa75f7-2b30-4659-9e25-dd3454c50ebb/

Published: 2026-09-16 · Source: NVD · Feed updated: 2026-09-16

This unknown severity vulnerability was published on 2026-09-16 via NVD.

vulnfeed aggregates 14123 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.