The vulnerability resides in a missing authorization check in the Eventin plugin for WordPress, allowing subscriber-level users and even unauthenticated visitors to confirm or complete orders, bypass payment for paid events, and deplete ticket inventory or trigger confirmation emails for tickets never purchased. This flaw permits the creation of orders with an order_access_token that is issued to anyone possessing the publicly emitted wp_rest nonce, effectively granting unauthorized users the same privileges as authenticated subscribers.

All installations of the arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin up to and including version 4.1.22 are affected.

The CVSS score of 4.3 places this flaw in the moderate risk range, and the EPSS score is not available, so the current exploitation probability is unclear. The flaw is not listed in the CISA KEV catalog. Exploitation is possible via the WordPress REST API from any front‑end page that displays the non‑ceasing nonce, meaning attackers can execute privileged actions without requiring complex setup. The most likely attack vector is a web request to the order creation or completion endpoints using the publicly exposed nonce.