Event Tickets and Registration CVE-2026-14822

No special configuration is required - the vulnerable REST endpoint is exposed by default whenever the plugin is installed and active on any WordPress site running a version before 5.29.0.1. The CVSS vector (PR:N, AC:L) confirms unauthenticated, low-complexity remote exploitation with no user interaction. The primary limiting factor is that the attacker must supply a valid, existing order ID; sequential or predictable IDs (common in WooCommerce-adjacent plugins) lower this barrier. Exploitation is constrained to integrity impact on order records only - there is no path to code execution, credential theft, or site takeover via this endpoint alone.

The CVSS 3.1 base score of 5.3 (Medium) is grounded in AV:N/AC:L/PR:N/UI:N - network-exploitable, zero authentication, trivially low complexity - but the impact is scoped to integrity only (I:L), with no confidentiality or availability consequences recorded. The low EPSS (0.14%, 4th percentile) contrasts with the existence of a public POC: this suggests the exploit is documented but not yet being leveraged at scale, possibly due to the limited business impact relative to higher-value WordPress vulnerabilities. The absence from CISA KEV is consistent with this. Real-world risk is primarily fraud-driven: in environments using this plugin for paid event registrations, an attacker could mark pending or failed orders as completed, potentially bypassing payment validation or triggering fulfillment without payment. For pure informational event sites without payment workflows, the practical impact is lower. The combination of no-auth exploitation and a public POC warrants prompt patching despite the moderate CVSS score.

An unauthenticated attacker probes a WordPress site, identifies the Event Tickets and Registration plugin is active (via plugin enumeration or public registration page metadata), and then enumerates valid order IDs - often sequential integers accessible through prior order confirmation pages or brute-force. The attacker sends a crafted HTTP request to the exposed order-management REST endpoint with the target order ID and a spoofed status value such as 'completed'. A publicly available POC exists making this straightforward to reproduce; the server applies the status change without any credential or permission check.