Event Tickets EUVD-2026-92322

Requires a valid authenticated account on the target WordPress site at a low privilege level (CVSS PR:L) - typically any self-registered role such as subscriber, customer, or event attendee - so sites that permit open user registration are more exposed than those with closed registration. The flaw is a missing authorization check on an Event Tickets plugin action (CWE-862), so exploitation targets default installations of Event Tickets version n/a through 5.30.0; no special non-default configuration or user interaction is indicated. Limiting factors: the required authentication (no anonymous/unauthenticated path per PR:L), the integrity-only impact (no data disclosure or denial of service), and dependence on the site actually running the affected plugin version.

This is a genuine-but-low-priority issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) scores 4.3 (Medium) and is internally consistent: network-reachable, low attack complexity, no user interaction, but requiring an authenticated low-privileged account (PR:L) and yielding only limited integrity impact (I:L) with no confidentiality or availability effect. The CWE-862 (Missing Authorization) classification and Patchstack's 'broken access control' title align with the I:L/C:N/A:N impact profile - an authenticated user performing an action they should not be authorized for, rather than data exfiltration or system compromise. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no signal of active or probable exploitation; status is 'no public exploit identified at time of analysis.' Net: a real authorization defect worth patching in maintenance windows, not an emergency. The main caveat is the PR:L requirement - exploitation presupposes the attacker already holds a valid, low-privileged WordPress account (e.g., subscriber/customer/attendee), which meaningfully narrows the realistic threat population on sites that do not allow open registration.

An attacker who holds a low-privileged authenticated account on a WordPress site running Event Tickets (≤5.30.0) sends a crafted request to a plugin endpoint that fails to verify the caller's authorization level, allowing them to modify ticket/event data they should not control. No user interaction is required and the attack is remote over the network, but a valid low-privilege login is a prerequisite. No public exploit code has been identified at the time of analysis.