EUVD-2026-94948
GHSA-ghv5-3c96-c756
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain low-privilege WordPress account
-
ExploitSend crafted request to Event Tickets endpoint
-
ExecutionBypass missing authorization check
-
ImpactRead or alter restricted ticket/event data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account at low privilege (PR:L) - e.g. a self-registered subscriber or ticket purchaser on a site running Event Tickets at or below 5.30.0.1 - to reach an endpoint lacking a proper authorization/capability check. No user interaction and no elevated role are needed, but the dependency on having any valid logged-in account is the key limiting factor: sites that do not allow user registration and have no low-trust accounts substantially reduce exposure. Impact is bounded to low-level unauthorized read/modify of Event Tickets data (C:L/I:L), with no availability effect. |
| Impact | This is a moderate-severity Missing Authorization flaw (CWE-862) in the Event Tickets WordPress plugin, scored CVSS 5.4 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The signals are consistent and point to a real-but-not-urgent issue: network-reachable and low-complexity, but requiring an authenticated low-privileged account (PR:L) and yielding only low confidentiality and integrity impact with no availability impact. No KEV listing, no public exploit, and no EPSS score were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The ceiling on impact (C:L/I:L, scope unchanged) and the authentication requirement make this a patch-in-normal-cycle item rather than an emergency, unlike the unauthenticated critical flaws that typically drive WordPress plugin incident response. Note the Patchstack 'Authentication Bypass' tag is somewhat imprecise - the CWE and description describe missing authorization (broken access control for an already-authenticated user), not an authentication bypass; this does not change the risk but should be read carefully. |
| Exploit ScenarioDerived | An attacker who holds a low-privilege WordPress account (for example a subscriber or event attendee registered on the site) sends a crafted request to an Event Tickets endpoint that fails to verify the caller's authorization level. Because the access-control check is missing, they read or modify ticket/event data they should not be able to touch. No public exploit code was identified at time of analysis, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Low-privilege authenticated users can bypass authorization on Event Tickets (a WordPress plugin by Liquid Web / StellarWP) versions up to and including 5.30.0.1, reaching functionality that lacks a proper capability check and thereby reading or modifying event and ticket data they should not control. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, CWE-862) - exploitation requires only any valid logged-in account, such as a self-registered subscriber or ticket purchaser, so sites that permit open registration carry the most exposure. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the Patchstack advisory makes the weakness straightforward to probe for on unpatched installations.
RemediationAI
The provided intelligence does not include a confirmed patched version number for Event Tickets, so verify current release status against the vendor/plugin page and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/event-tickets/vulnerability/wordpress-event-tickets-plugin-5-30-0-1-broken-access-control-vulnerability?_s_id=cve) and update the plugin to the first version published after 5.30.0.1 as soon as it is confirmed fixed - do not assume 5.30.0.1 itself is patched. Because exploitation hinges on holding any authenticated low-privilege account, the highest-value compensating control is to close the account supply: disable open WordPress registration (Settings → General → uncheck "Anyone can register") and audit existing Subscriber-level and ticket-purchaser accounts, accepting the trade-off that this breaks self-service signup and guest account creation for legitimate buyers. Additionally, review and if necessary restrict the endpoints involved by requiring stronger capabilities, and consider WAF or reverse-proxy rules that block unauthenticated or Subscriber-role requests to the plugin's admin-ajax/REST routes - noting that blanket blocking can break legitimate front-end RSVP and ticket-purchase flows. If the plugin's ticketing features are unused, deactivate and remove Event Tickets entirely, which eliminates the attack surface with no functional cost.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic Missing Authorization (CWE-862) condition in a WordPress plugin, meaning a handler - typically an AJAX action (admin-ajax.php), a REST API route, or an admin-post.php callback - is reachable but never validates that the calling user holds the required capability via current_user_can() or an equivalent role/capability check. WordPress's permission model separates authentication (is the request tied to a valid user session, i.e. wp_get_current_user()) from authorization (does that user hold the specific capability required by this action), and this code path performs only the former, or neither. The CVSS vector confirms the root characteristics: AV:N because the endpoint is reachable over HTTP, AC:L because no special conditions are needed, PR:L because a low-privilege account is the entry ticket, UI:N because no victim interaction is required, and C:L/I:L with A:N because the practical result is limited unauthorized read and modification of Event Tickets data without any denial-of-service effect. The affected component is the Event Tickets plugin (the free ticketing/RSVP companion to The Events Calendar) distributed through wordpress.org, with the EUVD entry confirming the version ceiling as Event Tickets 0 through 5.30.0.1.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable, low-complexity missing authorization exploitable by any authenticated low-privilege user (PR:L), granting limited unauthorized read/write (C:L/I:L) with no availability impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB