Event Tickets and Registration CVE-2026-3174

The target WordPress site must have the Event Tickets and Registration plugin installed and active at version 5.27.4 or earlier. No authentication is required - the CVSS vector PR:N/AC:L/UI:N confirms the return endpoint is unconditionally accessible to unauthenticated HTTP requests. For the financial-fraud impact to materialize, the Stripe payment gateway must be in active use on the site; however, the unauthorized credential overwrite itself can be performed regardless of whether Stripe is currently configured, pre-positioning for future fraud. The attacker must possess their own Stripe account to supply replacement credentials. Exploitation is bounded to WordPress deployments running this specific plugin; no other software is affected.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately encodes the attack surface: fully network-reachable, no complexity, no authentication, immediate integrity compromise. The C:N score is technically correct (no data exfiltration occurs), but the real-world financial impact of payment diversion substantially outpaces what a pure integrity score conveys - this is effectively financial fraud infrastructure handed to any opportunistic attacker. Even a mid-sized municipal IT team in sanok running community event ticketing on WordPress should treat this as urgent, since the revenue-critical nature of the targeted data (live payment processing credentials) elevates business risk well above what the CVSS number alone suggests. No EPSS score or CISA KEV listing is present in the provided intelligence, and no POC has been published; however, the attack requires only knowledge of the REST endpoint URL and possession of a Stripe account, both easily obtained, making the exploitation barrier effectively near zero once the plugin version is fingerprinted. Prioritization should reflect that this is an immediately monetizable attack with no authentication requirement.

An attacker identifies a WordPress site running Event Tickets and Registration ≤5.27.4 via plugin fingerprinting, then sends a single crafted unauthenticated HTTP request to the plugin's Stripe OAuth return endpoint supplying their own Stripe account tokens, publishable key, and account ID. The site stores the attacker's credentials without validation, and from that point forward, every ticket purchase by legitimate customers deposits funds into the attacker's Stripe account. The site owner may not discover the fraud until reconciling event revenue, potentially hours or days after the credential overwrite. No POC code has been publicly identified, but the attack is trivially constructable from the exposed source code.