What is the CVSS score of EUVD-2026-43360?

EUVD-2026-43360 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Event Tickets are affected by EUVD-2026-43360?

Event Tickets WordPress plugin (versions ≤5.28.5) contains a broken access control vulnerability allowing unauthenticated attackers to modify event data through missing authorization checks.

How to fix or mitigate EUVD-2026-43360?

Within 24 hours, scan all WordPress installations for Event Tickets plugin versions 5.28.5 or earlier to identify scope, and immediately implement Web Application Firewall (WAF) rules or network-level access controls to restrict modifications to plugin administrative functions. Within 7 days, notify event management stakeholders of the vulnerability, audit systems for any unauthorized data changes, and begin evaluation of alternative event management solutions as a permanent fix. Within 30 days, execute either a full migration to a patched alternative platform or disable the plugin on non-critical event systems; maintain daily backups to enable rapid recovery if unauthorized modifications are discovered.

Event Tickets EUVD-2026-43360

| CVE-2026-57705 HIGH

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Event Tickets Wordpress Plugin Nexcess

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network action with missing authorization (PR:N, AV:N, AC:L) enables data modification (I:H) but no disclosure or DoS (C:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:50 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.

AnalysisAI

Broken access control in the Event Tickets WordPress plugin (versions up to and including 5.28.5) lets remote unauthenticated attackers modify data they should not be able to reach because an authorization check is missing on a privileged action. The flaw carries a 7.5 CVSS with an integrity-only impact (I:H) and no confidentiality or availability effect, and there is no public exploit identified at time of analysis. It was disclosed by Patchstack and affects default installations of the plugin.

Technical ContextAI

Event Tickets is a WordPress plugin used to sell and manage event tickets and RSVPs on WordPress-based sites (CPE cpe:2.3:a:nexcess:event_tickets). The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints or actions perform a state-changing operation without verifying that the requester holds the required capability or role. In WordPress plugins this class typically arises when an AJAX handler, REST route, or admin-post action omits a current_user_can()/nonce-plus-capability check, so the access-control decision that should gate the operation is either absent or incorrectly configured, matching the disclosure's 'Incorrectly Configured Access Control Security Levels' phrasing.

RemediationAI

No vendor-released patch version is identified in the provided input, so the primary action is to consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/event-tickets/vulnerability/wordpress-event-tickets-plugin-5-28-5-broken-access-control-vulnerability) and upgrade to the next release above 5.28.5 once the vendor publishes it. As compensating controls until a fixed build is confirmed, restrict access to the plugin's AJAX/REST/admin-post endpoints at the web server or WAF layer (Patchstack provides virtual patching for exactly this CVE), which limits exposure but may block legitimate ticketing calls if rules are too broad; alternatively, temporarily deactivate the Event Tickets plugin if event-ticketing functionality is not business-critical, accepting the loss of ticket/RSVP features. Do not invent a version number - verify the exact patched release directly from the vendor or Patchstack before deploying.