EUVD-2026-51709
GHSA-rpwc-gx32-cjcf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Endpoint is network-exposed with no authentication (PR:N, AV:N); only order status integrity is affected with no data disclosure or service disruption.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.
AnalysisAI
Unauthenticated order status manipulation is possible in the Event Tickets and Registration WordPress plugin across all versions before 5.29.0.1, due to a completely absent authorization check on an order-management REST endpoint. Any remote actor - with no credentials or privileges - can alter the status of existing orders, enabling fraud scenarios such as marking unpaid orders as completed. A publicly available exploit exists per WPScan; however, EPSS at 0.14% (4th percentile) indicates mass exploitation has not materialized at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
The root cause is CWE-284 (Improper Access Control). WordPress REST API endpoints must explicitly define a permission_callback that enforces capability checks (e.g., manage_woocommerce, nonce verification, or equivalent). When this callback is absent or returns true unconditionally, WordPress grants unauthenticated access to the endpoint. The affected plugin's order-management route omits this check entirely, exposing write-capable order state transitions to the public internet. The affected CPE is cpe:2.3:a:unknown:event_tickets_and_registration:*:*:*:*:*:*:*:*, covering the full version range up to but not including 5.29.0.1. The plugin is designed to manage event registrations and ticket sales directly within WordPress, making order integrity a business-critical concern.
RemediationAI
Update the Event Tickets and Registration plugin to version 5.29.0.1 or later immediately; this release introduces the missing authorization enforcement on the affected REST endpoint. The patch is vendor-confirmed and referenced in the WPScan advisory at https://wpscan.com/vulnerability/ec32cf58-9fc0-4817-8492-92d80be74ef4/. If the plugin cannot be updated immediately, a compensating control is to add a WAF rule blocking unauthenticated HTTP requests (POST, PUT, PATCH) to the plugin's order-management REST route under /wp-json/; note this may disrupt legitimate frontend checkout flows that rely on the same route, so test carefully. Alternatively, temporarily deactivating the plugin eliminates exposure but also removes all event ticketing functionality. Enumerate all active plugin versions across your WordPress fleet using WP-CLI (wp plugin list --status=active) to identify unpatched instances at scale.
Unauthenticated payment credential hijacking in the Event Tickets and Registration WordPress plugin (StellarWP, all vers
Stored cross-site scripting in the Event Tickets and Registration WordPress plugin before 5.28.4 enables Editors and abo
Broken object-level authorization in the Event Tickets and Registration WordPress plugin before 5.29.0.1 allows any cont
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today