CVE-2026-84906: unknown eventin
Vulnerability summary
CVE-2026-84906 is a medium (CVSS 5.3) vulnerability in unknown eventin. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.4% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 4.1.24.
Timeline
- 16-09-2026PublishedVulnerability first disclosed.
- 16-09-2026Last modifiedVulnerability information updated.
Description
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
4%
Versus all other CVEs
30-day change
+0.01 pp
From 0.14% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- CWE-602Client-Side Enforcement of Server-Side SecurityThe product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
Affected systems
Unknown1 product
- eventin< 4.1.24
Wordpress1 product
- wp-event-solution≤ 4.1.23 (fixed in 4.1.24)
2 vendors · 2 products