Event Tickets CVE-2026-110902

Exploitation requires an authenticated session on the target WordPress site (CVSS PR:L), so the attacker must hold a valid account - the realistic precondition is a site that permits user registration or that issues accounts to attendees/customers via Event Tickets. The flaw is reachable remotely over HTTP (AV:N) with low complexity and no victim interaction (AC:L/UI:N) against affected versions up to 5.30.1. The limiting factor is the authentication requirement and the scope: impact is confined to unauthorized access/modification of ticketing objects addressable by a user-controlled key (I:L, C:N, A:N per the vendor vector); sites that do not expose self-service accounts substantially reduce the attacker population.

This is a moderate-severity IDOR/broken-object-level-authorization flaw (CWE-639) with a vendor (Patchstack) CVSS 3.1 score of 4.3 via vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The signals are internally consistent and point to a real-but-bounded issue rather than an urgent emergency: network vector and low complexity ease exploitation, but PR:L means a valid authenticated account is required, and the impact is scoped to low integrity only (C:N/A:N), i.e. an attacker can manipulate or access objects they should not by substituting a user-controlled key, without broad data disclosure or availability loss. No EPSS score, CISA KEV listing, SSVC decision data, or POC was provided in the input, so exploitation-probability and automatability cannot be quantified. There is no conflict among the provided signals; the main caveat is that CWE-639 IDORs frequently also leak information (confidentiality), yet the vendor vector sets C:N - if the affected object exposes attendee/ticket data this could understate confidentiality impact, so verify the concrete object scope with the vendor advisory. Overall this is a 'patch in normal cycle' item for most sites, not a drop-everything critical.

An authenticated low-privilege user (e.g. a registered site subscriber or attendee) on a WordPress site running Event Tickets ≤5.30.1 sends a request that references another user's ticket, order, or attendee object by manipulating an ID or key parameter. Because access control on that key is improperly enforced, the server returns or modifies the other user's object, allowing unauthorized access to or tampering with ticketing data. No public exploit code is identified at time of analysis, and the attack requires a valid account but no victim interaction.