CVE-2025-1766
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Published Mar 20, 2025
CWE ID 862
Summary
CVE-2025-1766 is a vulnerability affecting the Eventin plugin for WordPress. This issue allows unauthenticated attackers to modify data within the Event Manager, Events Calendar, Tickets, and Registrations components. Specifically, the 'payment_complete' function in all versions up to 4.0.24 lacks sufficient capability checks, enabling attackers to alter ticket payment statuses to 'completed'. This vulnerability poses a significant risk for financial loss.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.