Technical impact
The vulnerability is in the Eventin WordPress plugin before version 4.1.19. The plugin fails to properly restrict the actions that can be performed with a guest checkout order_token. An unauthenticated user can supply the token for an unpaid order and mark it as completed, thereby receiving a paid ticket without any payment. This allows an attacker to generate valid tickets and gain paid access to event services without covering the cost. The flaw is an improper access control weakness, CWE-862.
Affected Systems
Eventin plugin (WordPress) before 4.1.19. Users running any supported WordPress instance with the plugin version lower than 4.1.19 are at risk.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity, while the EPSS score of < 1% suggests a very low exploitation probability. Despite being unavailable in the CISA KEV catalog, the lack of authentication required for exploitation makes it a notable threat. The attack vector is likely an unauthenticated HTTP request containing a valid order_token, which can be obtained by any user or through enumeration. This flaw allows unrestricted order completion and ticket issuance, posing a risk to the integrity of event order processes.
