Eventin WordPress plugin accepts an attacker‑supplied order status and does not authorize order creation, allowing unauthenticated users to create orders marked as paid without completing any payment. This flaw (CWE‑639) enables fraud and financial loss by generating paid orders from illicit transactions, bypassing the normal payment process. The consequence is the creation of records that may be processed as valid sales, compromising both integrity and confidentiality of payment data.

Vulnerable systems are WordPress sites using the Eventin plugin with any version prior to 4.1.16. The exact vendor is listed as Unknown:Eventin in the CNA data, and the flaw exists across all affected releases of this plugin version. Administrators of such sites should verify the plugin version they are running.

The CVSS score of 7.5 reflects the high impact of the flaw, while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been observed in widespread exploitation. Likely exploitation requires an unauthenticated HTTP request to the order creation endpoint and transmission of a custom status value. Once exploited, the attacker can create paid orders without actual payment, potentially leading to revenue loss and customer dissatisfaction.