Event Tickets EUVD-2026-43360

Exploitation requires only network access to a WordPress site running Event Tickets version 5.28.5 or earlier with the plugin active; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special privileges, and no user interaction are needed against a default configuration. The concrete prerequisite is that the vulnerable plugin action must be reachable - i.e., the Event Tickets plugin installed and enabled and its endpoint exposed to the requester. Limiting factors are minimal: the main constraints are that the site must actually run the affected plugin/version and that the impact is confined to integrity (data modification), not information disclosure or availability, so an attacker cannot use this flaw alone to read protected data or take the site offline.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated action requiring no user interaction, which is why the score is 7.5 despite the impact being limited to integrity - there is no data disclosure (C:N) and no denial of service (A:N). This is a genuine remote pre-auth issue, so it should not be dismissed as high-CVSS-but-low-real-risk; however, the absence of a KEV listing and of any public POC means there is no evidence of active or imminent exploitation. No EPSS score and no SSVC decision data were provided in the input, so automatability and exploitation-status cannot be quantified from these signals - treat urgency as driven by the pre-auth integrity impact rather than by confirmed exploitation. The impact scope also matters: with C:N/A:N the practical risk is unauthorized data modification (e.g., manipulating ticket/RSVP records), not full site takeover, unless the modified state can be chained to something more severe.

An attacker sends a crafted HTTP request directly to a vulnerable Event Tickets endpoint on a target WordPress site without logging in, invoking a privileged action that lacks an authorization check. Because no authentication or user interaction is required and complexity is low, the attacker can alter ticket, attendee, or RSVP data at scale across exposed sites. No public exploit code is currently identified, so this scenario is inferred from the CVSS vector rather than a demonstrated PoC.