Event Manager, Events Calendar, Tickets, Registrations – Eventin Missing Authorization Vulnerability in Payment Status Update

A vulnerability exists in the Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress, in all versions through 4.0.24. The issue arises from a lack of proper capability checks in the 'payment_complete' function, allowing unauthenticated users to change the status of ticket payments to 'completed'. This vulnerability could lead to financial losses.

Impact

Exploitation of this vulnerability allows for unauthorized users to change payment statuses to 'completed', potentially causing financial discrepancies.

Remediation

Users are advised to update the plugin to version 4.0.25 or later.