CyberRota Analysis
AI-GeneratedThe Eventin WordPress plugin prior to version 4.1.24 has a vulnerability that allows unauthenticated users to manipulate order finalization when the offline payment method is enabled. This oversight, which involves an exposed nonce and a lack of ownership verification, enables attackers to reset orders and invalidate paid tickets, posing a significant risk to event organizers. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation.
Original NVD Description
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset any existing order and its attendees to a pending state and thereby invalidate paid tickets.