What is the CVSS score of CVE-2026-57400?

CVE-2026-57400 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Event Tickets Manager CVE-2026-57400

EUVD-2026-43472 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Event Tickets Manager For Woocommerce Wp Swings

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable with no auth or interaction required; impact limited to partial integrity and availability with no confidentiality loss, consistent with unauthorized plugin action invocation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:26 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets Manager for WooCommerce: from n/a through <= 1.5.5.

AnalysisAI

Missing Authorization (CWE-862) in the Event Tickets Manager for WooCommerce WordPress plugin versions through 1.5.5 allows unauthenticated remote attackers to exploit incorrectly configured access control levels, resulting in limited but unauthorized modification of data and disruption of availability. The CVSS vector (PR:N/UI:N) confirms exploitation requires no authentication and no user interaction, lowering the barrier for abuse against any WordPress site with the plugin installed and active. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected component is the WP Swings 'Event Tickets Manager for WooCommerce' plugin (CPE: cpe:2.3:a:wp_swings:event_tickets_manager_for_woocommerce:*:*:*:*:*:*:*:*), a WordPress plugin extending WooCommerce with event ticketing functionality. CWE-862 (Missing Authorization) indicates the plugin registers one or more endpoints - likely WordPress AJAX actions or REST API routes - without enforcing capability checks (e.g., current_user_can()) before executing privileged operations. This is a classic WordPress plugin pattern failure: functionality is exposed over HTTP without verifying whether the caller has permission to invoke it, distinct from authentication bypass (which bypasses identity verification) - here, identity may be irrelevant because no authorization gate exists at all. The tag 'Authentication Bypass' from Patchstack suggests the missing check effectively grants unauthenticated actors access to privileged plugin actions.

RemediationAI

Update the Event Tickets Manager for WooCommerce plugin to a version beyond 1.5.5. The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/event-tickets-manager-for-woocommerce/vulnerability/wordpress-event-tickets-manager-for-woocommerce-plugin-1-5-5-broken-access-control-vulnerability) should be consulted for the confirmed patched release version, as no exact fix version number was included in the available source data - the patched version is not independently confirmed from this dataset. If an immediate update is not possible, a compensating control is to deactivate the plugin entirely until the patch is applied; this eliminates the attack surface but disables all event ticketing functionality. Web application firewall (WAF) rules targeting unauthorized access to the plugin's specific AJAX actions or REST endpoints may also reduce exposure, but the specific endpoint names are not confirmed in the available data and such rules should be validated against false-positive risk.