Event Tickets and Registration EUVD-2026-51710

Exploitation requires a valid WordPress user account at contributor level or above on the target site - unauthenticated users cannot exploit this vulnerability. The target WordPress installation must have the Event Tickets and Registration plugin installed, activated, and running a version prior to 5.29.0.1. At least one event with seating configured must exist and be owned by a different user than the attacker. No special network position, protocol manipulation, or race condition is required beyond authenticated HTTP access to the WordPress site. Exploitation is limited to integrity impact on event data only - there is no code execution, credential theft, or availability disruption possible via this flaw. Sites where all WordPress users are equally trusted (single-author or all-admin configurations) are not meaningfully exposed.

The official NVD CVSS score of 2.2 is derived from a vector of AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N, which appears to misclassify the privilege requirement. The CVE description explicitly states exploitation is possible for 'contributor-level access and above,' which in WordPress maps to PR:L (low privilege), not PR:H (high/admin). This discrepancy is a significant signal conflict - the NVD score likely underestimates real-world risk for multi-author WordPress sites where contributor accounts are routinely issued to guest bloggers or event organizers. The EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability, and no CISA KEV listing confirms active mass exploitation. However, a public exploit exists via WPScan, lowering the skill bar. The practical blast radius is limited to integrity: no data exfiltration, no availability impact, no remote code execution. Real-world risk is most acute for large, multi-author WordPress event platforms where untrusted contributors could sabotage competitor events or manipulate ticketing to commit fraud.

An attacker with a contributor-level account on a multi-author WordPress site hosting events with the plugin enabled crafts a request to one of the plugin's seating action endpoints, supplying the event ID of an event owned by a different author. Because the plugin does not verify ownership, the attacker's request succeeds and overwrites the victim event's seating layout, ticket inventory counts, or attendee seat assignments. A public proof-of-concept is available via WPScan, meaning the specific vulnerable endpoints and request parameters are documented, lowering the barrier to exploitation for authenticated insiders or compromised contributor accounts.