What is the CVSS score of EUVD-2026-49238?

EUVD-2026-49238 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Event Tickets EUVD-2026-49238

Q: Which versions of Event Tickets are affected by EUVD-2026-49238?

An unauthenticated broken access control vulnerability in Event Tickets through version 5.29.0.1 allows remote attackers to modify event ticket data without authentication.

| CVE-2026-65567 MEDIUM

Missing Authorization (CWE-862)

2026-07-27 Patchstack

GHSA-j9rv-h4v3-795f

Authentication Bypass Event Tickets

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible, no complexity or user interaction; only low integrity impact without confidentiality or availability effects.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 15:04 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

AnalysisAI

An unauthenticated broken access control vulnerability in Event Tickets through version 5.29.0.1 allows remote attackers to modify event ticket data without authentication. The vulnerability affects installations of the WordPress plugin where default configurations are in place, permitting unauthorized integrity impact. No active exploitation or public exploit code has been reported at the time of this analysis.

Technical ContextAI

The vulnerability resides in the Event Tickets plugin for WordPress, developed by Nexcess. It is a CWE-862: Missing Authorization issue, which occurs when the application does not verify that a requestor has the required permissions to perform a protected action. According to the CPE string (cpe:2.3:a:nexcess:event_tickets:*:*:*:*:*:*:*:*), all versions up to and including 5.29.0.1 are affected. The flaw allows an unauthenticated attacker to bypass access controls on a publicly accessible endpoint, enabling alteration of ticket-related data with low integrity impact and no confidentiality or availability consequences.

RemediationAI

Update the Event Tickets plugin to a version higher than 5.29.0.1 immediately, as per the Patchstack advisory. No workarounds are detailed in the available references. If patching is delayed, consider restricting access to the WordPress site via IP allow-listing or a web application firewall rule that blocks requests to the vulnerable endpoint (though the exact endpoint is not publicly disclosed). Disabling the plugin entirely will mitigate the risk but will break ticketing functionality.