Event Tickets EUVD-2026-49238

No authentication or user interaction is required; the vulnerability is exploitable via network requests to any affected WordPress site where Event Tickets is active in its default configuration. No special configuration, non-default setting, or privilege enables the flaw - it arises from a missing authorization check on a plugin endpoint. There are no limiting conditions beyond the target running a vulnerable version.

The CVSS 3.1 base score is 5.3 (Medium), with a vector indicating network attack surface, low complexity, no privileges, and no user interaction, but only a low integrity impact. EPSS data is not available for this CVE, so exploitation probability estimates are incomplete. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept code has been identified. Using SSVC decision factors: exploitation status is none, automatable (likely due to AV:N and AC:L), and technical impact is partial. The real-world risk is moderate - an automated attack is possible, but the low impact limits the urgency. Missing EPSS and KEV signals prevent a high-confidence risk assessment; the low CVSS integrity score suggests this may be a nuisance event rather than a critical threat.

An attacker scans for WordPress sites running Event Tickets <= 5.29.0.1, then sends a specially crafted HTTP request to a vulnerable endpoint that lacks proper authorization checks. This allows the attacker to modify ticket-related data, such as prices or availability, without authentication. With a publicly accessible endpoint and no user interaction, an automated script could exploit this across multiple installations.