EUVD-2026-51710
GHSA-cfmh-2g6m-xpvm
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Contributor access is PR:L in WordPress; no special conditions needed once authenticated, so AC:L; impact is integrity-only on event data.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own.
AnalysisAI
Broken object-level authorization in the Event Tickets and Registration WordPress plugin before 5.29.0.1 allows any contributor-level (or higher) WordPress user to overwrite the seating layout, ticket inventory, and attendee seat assignments for events they do not own. The flaw stems from insufficient ownership verification on seating-related actions, meaning a low-privileged authenticated user can manipulate another author's event data without restriction. No public exploitation in the wild has been confirmed by CISA KEV, but a public proof-of-concept exists per WPScan reporting, and the EPSS score of 0.13% (3rd percentile) reflects minimal observed scanning or exploitation activity at time of analysis.
Technical ContextAI
The affected component is the Event Tickets and Registration WordPress plugin, identified in CPE as cpe:2.3:a:unknown:event_tickets_and_registration:*:*:*:*:*:*:*:*. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a class of flaw where object ownership or access rights are enforced using identifiers that the attacker can supply or manipulate, without the server independently verifying that the requesting user is the legitimate owner of the referenced resource. In WordPress plugin context, this typically manifests as AJAX or REST endpoint handlers that accept an event or post ID from the request body and operate on it without confirming the current user owns or is authorized to edit that specific event. The affected seating actions span layout configuration, ticket inventory state, and per-attendee seat assignments - all high-value integrity targets for an event organizer.
RemediationAI
Upgrade the Event Tickets and Registration WordPress plugin to version 5.29.0.1 or later, which is the vendor-released patch addressing this authorization flaw. The fix is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/50fcd505-11bc-4208-aa27-54651f82e80e/. If immediate upgrade is not possible, a compensating control is to audit and restrict contributor-level accounts on the WordPress site - removing contributor access from untrusted users eliminates the attack surface, though it limits legitimate functionality. Site administrators can also temporarily disable the seating feature within the plugin if it is not actively in use, reducing exposure while the patch is applied. Note that restricting contributor accounts may block legitimate content contributors from posting, so assess this trade-off against the site's authoring workflow before applying.
Unauthenticated order status manipulation is possible in the Event Tickets and Registration WordPress plugin across all
Unauthenticated payment credential hijacking in the Event Tickets and Registration WordPress plugin (StellarWP, all vers
Stored cross-site scripting in the Event Tickets and Registration WordPress plugin before 5.28.4 enables Editors and abo
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today