Event Tickets EUVD-2026-36827

The target WordPress site must have the Event Tickets plugin by Liquid Web / StellarWP installed and active at version 5.27.5 or earlier. The CVSS vector (PR:N/AC:L/UI:N/AV:N) confirms no authentication is required, no user interaction is needed, and no complex preconditions exist beyond network reachability of the WordPress installation. Exploitation is bounded by unchanged scope (S:U), meaning the attacker's impact is limited to the Event Tickets plugin's own functionality and cannot directly compromise WordPress core, the database, or other plugins through this vulnerability alone. Confidentiality is unaffected (C:N), narrowing attacker outcomes to integrity disruption (e.g., unauthorized ticket registration) and availability degradation of ticketing features. Sites that have disabled or not installed the Event Tickets plugin are not affected.

The CVSS 3.1 Medium score of 6.5 with vector AV:N/AC:L/PR:N/UI:N reflects a low-friction, network-exploitable attack path that requires no credentials and no victim interaction - a combination that meaningfully lowers the barrier for opportunistic exploitation by automated scanners or unskilled attackers. However, the constrained impact metrics (C:N/I:L/A:L) bound the real-world damage: attackers cannot exfiltrate data, escalate to full site compromise, or achieve remote code execution through this vulnerability alone. No EPSS score was included in the available intelligence data, preventing probability-of-exploitation comparison. The vulnerability is absent from CISA's KEV catalog and no POC code has been identified, which together suggest no widespread or confirmed active exploitation at time of analysis. The realistic priority is moderate-to-high for WordPress operators running event-driven sites: the zero-friction attack path warrants prompt patching, but defenders should not treat this as a critical breach risk given the narrow blast radius limited to Event Tickets plugin functionality.

An unauthenticated attacker sends a crafted HTTP request to a publicly accessible WordPress site running Event Tickets 5.27.5 or earlier, supplying a spoofed parameter, header, or token value that tricks the plugin's access control logic into treating the request as authorized per the CWE-290 mechanism. With the bypass achieved, the attacker could perform restricted ticketing operations - such as registering for paid or access-controlled events without payment, manipulating ticket quantities, or disrupting event state - without holding any WordPress user account. No POC exploit code has been identified, but the AC:L rating indicates the bypass mechanism is straightforward to replicate once discovered.