The Eventin WordPress plugin fails to tie a confirmed payment receipt to the specific order it should satisfy. It only checks that the gateway reports a successful identifier. Consequently, an unauthenticated visitor can replay a legitimate low‑value payment and mark any unpaid order as paid, enabling fraudulent transactions without adding funds.

This flaw exists in all installations of the Eventin plugin with versions earlier than 4.1.24. No other vendor or product is noted as affected.

The CVSS score of 5.3 indicates a moderate severity vulnerability, and the EPSS score of less than 1% suggests that exploitation is currently uncommon. The issue is not listed in the CISA KEV catalog. An attacker can exploit the fault by sending an unauthenticated request to the plugin’s payment handling endpoint, replaying a previously captured payment reference. Because no authentication or order‑validation checks are enforced, the replay can succeed with minimal effort.