Event Tickets EUVD-2026-114274

Requires a valid authenticated account with at least low privileges on the target WordPress site running Event Tickets version n/a through 5.30.2 (PR:L); remote and network-reachable with low complexity and no user interaction once authenticated. The exact feature, endpoint, or configuration that lacks the authorization check is not described in the available sources. Limiting factors: exploitation is impossible for fully unauthenticated attackers, and impact is confined to low integrity effects (C:N/I:L/A:N) - no data disclosure or denial of service. Sites that do not allow self-registration or that restrict low-privilege accounts further constrain exposure.

This is a moderate, not critical, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, low-complexity flaw that requires an already-authenticated low-privilege account (PR:L) and yields only a limited integrity impact (I:L) with no confidentiality or availability loss - consistent with a CWE-862 Missing Authorization / broken access control issue where a low-privileged user can perform an action they should not. The vuln.today decision label is 'this_month', signaling a scheduled-remediation rather than an emergency. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no current signal of active exploitation or mass scanning. The net picture is a real but bounded issue: exploitation is gated behind authentication and the damage is limited to low-integrity effects, so it ranks below internet-facing unauthenticated or code-execution flaws. Note that EPSS, KEV, SSVC automatable/technical-impact fields, and a confirmed fixed version are all absent from the input, so prioritization rests on the CVSS vector and the Patchstack report alone.

An attacker who holds a low-privilege authenticated account on a WordPress site running Event Tickets (≤ 5.30.2) sends a crafted request to a plugin endpoint that fails to enforce proper authorization, allowing them to modify data or perform an action reserved for higher-privilege roles. The low attack complexity means no special timing or configuration is needed once the account exists, but the impact is limited to integrity (I:L). No public exploit identified at time of analysis; the trigger is not described in detail in the available sources.