The vulnerability is in the Eventin WordPress plugin before version 4.1.19. The plugin fails to properly restrict the actions that can be performed with a guest checkout order_token. An unauthenticated user can supply the token for an unpaid order and mark it as completed, thereby receiving a paid ticket without any payment. This allows an attacker to generate valid tickets and gain paid access to event services without covering the cost. The flaw is an improper access control weakness, CWE‑284.

Eventin plugin (WordPress) before 4.1.19. Users running any supported WordPress instance with the plugin version lower than 4.1.19 are at risk.

The vendor has not assigned an EPSS score, but the lack of authentication required for exploitation indicates a high potential. The vulnerability is not listed in CISA KEV, yet the impact of unauthorized order completion and ticket creation makes it a high value target for attackers. The likely attack vector is an unauthenticated HTTP request containing a valid order_token, which can be obtained by any user or through enumeration. The absence of a CVSS score implies limited public data; however, the nature of the flaw suggests a serious risk to confidentiality, integrity, and availability of event management.