Event Tickets EUVD-2026-114185

Requires an authenticated low-privilege account on a WordPress site with the Event Tickets plugin installed at version 5.30.2 or earlier (PR:L); no user interaction is needed (UI:N) and the vector is network-reachable (AV:N). Exploitation is limited to actions available through the specific plugin feature with the missing authorization check - the precise endpoint, parameter, or access-control level affected is not described in the available sources. Limiting factors for defenders: the attacker must first obtain a valid account on the target site, the impact is confined to limited confidentiality exposure (C:L, no integrity or availability impact), and sites not running the vulnerable plugin version are unaffected.

This is a moderate-severity issue (CVSS 4.3) whose signals point to a real but low-urgency problem rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network-reachable, low-complexity exploitation requiring an existing low-privilege authenticated account (PR:L), with only limited confidentiality impact and no integrity or availability impact. The vuln.today priority is 'this_month' (not act_now/emergency), consistent with a meaningful-but-not-urgent finding. There is no CISA KEV listing (not confirmed actively exploited) and no EPSS score was provided in the input, so widespread automated exploitation cannot be inferred from the available data. No verified working exploit code is indicated - the sole reference is the Patchstack advisory entry. The practical risk is a low-privilege authenticated user (any registered WordPress account, depending on the endpoint) abusing missing authorization checks to reach data or actions they should not. Because this is an authorization flaw on a widely installed WordPress plugin, it is a legitimate patch-this-cycle item, but the authentication requirement and limited (confidentiality-only, Low) impact keep it well below the priority of an unauthenticated RCE.

An attacker registers or already holds a low-privilege account on a WordPress site running Event Tickets (≤5.30.2) and sends a request to a plugin endpoint that fails to enforce proper authorization, returning or exposing event/ticket data belonging to other users or restricted contexts. No user interaction or high privileges are needed beyond the initial low-level authenticated session. No verified working exploit code is indicated in the provided data; only the Patchstack advisory is referenced.