Event Tickets CVE-2026-105891

Requires a valid authenticated WordPress account on the target site (CVSS PR:L), so the attacker must already be able to log in at a low privilege level such as a subscriber/customer role. The target must run Event Tickets version 5.30.0.1 or earlier. Exploitation is limited by this authentication requirement and by the vulnerability's scope: it grants only an unauthorized restricted action with limited integrity impact (I:L, C:N, A:N), not full account takeover or data disclosure. No user interaction by a victim is needed (UI:N), and no special non-default configuration is indicated in the description.

This is a genuine-but-moderate issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, low-complexity flaw that nonetheless requires an authenticated low-privileged account (PR:L) and yields only limited integrity impact with no confidentiality or availability loss - consistent with CWE-862 Missing Authorization, where an under-privileged but logged-in user can invoke an action they should not. No EPSS score, KEV listing, SSVC decision, or public POC was supplied, so there is no signal of active or imminent exploitation; the only source is a Patchstack-reported advisory. The 'Authentication Bypass' tag conflicts with the data: PR:L and CWE-862 indicate a broken-access-control/authorization flaw for already-authenticated users, not a true authentication bypass - treat the tag with caution. Net: a legitimate access-control defect worth patching on a normal cycle, but the authentication requirement and low, integrity-only impact keep real-world risk modest absent any exploitation evidence.

An attacker who already holds a low-privileged WordPress account (e.g., a subscriber or any authenticated role) on a site running Event Tickets ≤5.30.0.1 sends a crafted request to a plugin endpoint that fails to verify the caller's authorization. Because the missing check allows an incorrectly-scoped access level, the attacker performs a restricted ticket/event action they should not be permitted to, altering plugin-managed data. No public exploit code was identified at time of analysis.