Unrated severityNVD Advisory· Published Mar 20, 2025· Updated Apr 8, 2026
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update
CVE-2025-1766
Description
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: <=4.0.24
- arraytics/Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)v5Range: 0
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.