Event Tickets CVE-2026-97634

Requires an authenticated WordPress account with contributor-level privileges or higher (PR:L). The attacker must supply a post_id for a post they authored, because the can_access_page() gate validates only post authorship rather than the edit_others_posts capability - meaning any contributor who creates their own post can reach the vulnerable 'orderby' parameter in the Tickets Commerce Order Repository. Exploitation is limited to deployments of the Event Tickets and Registration plugin at version 5.29.5 or earlier, and to sites that grant contributor-or-higher accounts (e.g., open registration or multi-author/community sites). Impact is confined to reading database contents; no write or availability impact is indicated.

This is a moderate, authentication-gated priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms a network-reachable, low-complexity attack with no user interaction, but PR:L means a valid WordPress account is required - specifically contributor-level access. The impact is scoped to confidentiality only (C:H, I:N, A:N): the SQLi extracts data but is not described as enabling modification or denial of service. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation likelihood signals are absent - by the precision rules this is 'no public exploit identified at time of analysis.' The notable amplifier is the authorization logic flaw: the can_access_page() gate checks only post authorship, not the edit_others_posts capability, so a low-privilege contributor who authored a post can reach the vulnerable 'orderby' code path - lowering the effective barrier within the PR:L class. Net: a genuine data-exfiltration risk on any site that permits contributor registration, but the requirement for an authenticated contributor account substantially narrows real-world exposure compared to an unauthenticated flaw.

An attacker registers or obtains a contributor-level account on a WordPress site running the Event Tickets and Registration plugin (≤5.29.5), authors a post, then supplies that post_id to pass the authorship-only access gate. They inject crafted SQL through the 'orderby' parameter to append subqueries to the order-repository query, extracting sensitive database contents such as user credentials, order data, or secrets. No public exploit code was identified, but the low attack complexity makes manual exploitation straightforward for an authenticated user.