Event Tickets Manager EUVD-2026-43472

Per the CVSS vector (PR:N/UI:N/AV:N/AC:L), no authentication and no user interaction are required, and exploitation is feasible from any network location without special conditions. The limiting prerequisite is that the Event Tickets Manager for WooCommerce plugin by WP Swings must be installed, active, and running version 1.5.5 or earlier on a WordPress site also running WooCommerce. Impact is constrained to limited integrity and limited availability (I:L/A:L) - confidentiality is not impacted (C:N), ruling out direct data theft. The specific vulnerable plugin action or endpoint is not named in the available data, meaning an attacker would need to enumerate plugin-registered endpoints to identify the exact attack surface.

The CVSS 6.5 Medium score is supported by a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-interaction (UI:N) attack profile, with impact capped at limited integrity (I:L) and availability (I:L) - no confidentiality loss is indicated (C:N). This places it in a common category of WordPress plugin access-control flaws: broadly reachable but bounded in damage. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. The absence of a KEV listing and the lack of any identified POC suggests opportunistic mass exploitation has not yet materialized. Practically, the risk is meaningful for any site running this plugin in versions through 1.5.5, particularly if the plugin manages paid or access-controlled event ticketing, where unauthorized integrity modifications (e.g., ticket state changes, event data manipulation) could cause business disruption or fraud. The bounded impact (L/L, no confidentiality) somewhat limits blast radius compared to a full RCE or data-exfiltration class flaw.

An unauthenticated attacker identifies a WordPress site running Event Tickets Manager for WooCommerce version 1.5.5 or earlier, then sends a crafted HTTP POST request to the site's WordPress AJAX handler or REST API endpoint exposed by the plugin, bypassing the absent authorization check to invoke a privileged plugin action - such as modifying event ticket availability, altering ticket status, or disrupting the ticketing workflow. No public POC exists at time of analysis, but the low complexity and lack of authentication make this straightforward to exploit once the specific vulnerable endpoint is identified.