Event Tickets Manager for WooCommerce EUVD-2026-36920

The target must be a WordPress site running the WP Swings 'Event Tickets Manager for WooCommerce' plugin at version 1.5.3 or earlier with the vulnerable endpoint reachable over the network (the default for any public WordPress install). No authentication, no user interaction, and no special configuration toggle is required per the CVSS vector PR:N/UI:N. The only meaningful limits on exploitation are that the plugin must be installed and active, that WooCommerce (its declared dependency) must be present so the affected code path loads, and that the site must not be fronted by a WAF rule that already filters anonymous calls to the plugin's admin-ajax or REST routes.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates a network-reachable, low-complexity attack with no authentication or user interaction, which is consistent with an unauthenticated WordPress endpoint. Impact is scoped to integrity only (I:H, C:N, A:N), meaning an attacker can tamper with plugin-managed state (tickets, events, configuration) but the vendor does not credit data disclosure or denial of service. EPSS, KEV status, and SSVC data are not provided in the input, so real-world exploitation probability cannot be quantified; however, WordPress plugin broken-access-control issues are routinely automated against the install base, so the practical risk for exposed sites is meaningful even without confirmed in-the-wild activity. No public exploit was identified at time of analysis, but Patchstack's disclosure typically precedes detection rules and PoCs, so defenders should treat patching as time-sensitive.

An unauthenticated attacker enumerates WordPress sites running Event Tickets Manager for WooCommerce <= 1.5.3 and sends crafted HTTP requests directly to a plugin endpoint that lacks an authorization check, invoking an action that should be gated to administrators or ticket owners. Because no user interaction or credentials are required (AV:N/AC:L/PR:N/UI:N), the attacker can script the request across many sites to modify event or ticket data at scale. No public PoC has been identified yet, but the advisory provides enough surface for one to be derived quickly.