EUVD-2026-94954
GHSA-mvfx-6788-f58w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site endpoint
-
ExploitSubmit request with manipulated object ID
-
ExecutionBypass ownership/authorization check
-
ImpactModify unauthorized ticket/attendee data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires the StellarWP Event Tickets plugin (version through 5.30.0.1) installed and active on a reachable WordPress site, and an endpoint that accepts a user-controlled key (object identifier such as ticket, order, or attendee ID) used to locate resources without a server-side ownership check. The supplied vector indicates no special configuration, authentication, or user interaction (AV:N/AC:L/PR:N/UI:N); the principal limiting factor is that impact is confined to integrity of specific records (I:L) with no confidentiality or availability effect, and that the true privilege requirement should be confirmed since many comparable plugin IDORs require at least a low-privileged authenticated session. |
| Impact | This is a moderate-severity authorization bypass (CWE-639, IDOR) in the StellarWP Event Tickets WordPress plugin, rated CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vector signals network-reachable, low-complexity exploitation with no privileges or user interaction, but impact is narrow: integrity-only and limited (I:L), with no confidentiality or availability effect - consistent with manipulating a user-controlled key to alter or access objects the attacker should not control, rather than a full takeover. No EPSS score, CISA KEV listing, or public POC is provided in the input, so exploitation probability signals are absent; per available data this is 'no public exploit identified at time of analysis.' The low integrity impact and lack of exploitation evidence make this a routine patch-priority item rather than an emergency, though the PR:N rating (unauthenticated) warrants attention for internet-facing WordPress sites. One caveat: many Event Tickets broken-access-control issues historically require at least a subscriber/authenticated session, yet the supplied vector states PR:N - verify the true privilege requirement with the Patchstack/vendor advisory before treating it as fully unauthenticated. |
| Exploit ScenarioDerived | A remote attacker sends crafted requests to the Event Tickets plugin, substituting an identifier (e.g., ticket, attendee, or order ID) in a user-controlled parameter to reference objects belonging to other users. Because access is keyed on that attacker-supplied value without a proper ownership check, the attacker modifies or accesses data outside their authorization scope. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Authorization bypass in the StellarWP Event Tickets WordPress plugin (versions through 5.30.0.1) allows attackers to manipulate a user-controlled object key - such as a ticket, order, or attendee identifier - so that records they do not own can be located and altered, because the affected endpoint performs no server-side ownership check. The flaw is rated CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, confining impact to the integrity of specific records with no confidentiality or availability effect. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the effective privilege requirement should be validated because comparable WordPress-plugin IDORs frequently require at least a low-privileged authenticated session despite a PR:N vector.
RemediationAI
No vendor-released patch version is identified in the available data - the sole reference is the Patchstack vulnerability record, so the first action is to check that advisory and the StellarWP/Liquid Web release notes for a fixed Event Tickets build and upgrade the plugin as soon as a patched version is published, noting that the assessed impact (integrity-only, I:L) makes this a scheduled-maintenance priority rather than an emergency. Until a fix is confirmed, the most reliable compensating control is to deactivate the Event Tickets plugin on any site that does not need ticketing, accepting the loss of event, attendee, and order functionality; where the plugin must stay live, restrict the ticket, order, and attendee AJAX/REST endpoints to trusted networks or authenticated roles only, understanding that this may break legitimate front-end attendee self-service. A WAF or reverse-proxy rule that rejects requests whose object-identifier parameters reference records outside the caller's session is a useful stopgap but requires per-endpoint tuning and can produce false positives on legitimate multi-ticket orders; because IDOR is a server-side authorization defect, no client-side or perimeter control fully substitutes for the missing ownership check, and sites should also monitor logs for enumeration patterns against these identifiers while the patch is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-639, Authorization Bypass Through User-Controlled Key, the classic Insecure Direct Object Reference (IDOR) class in which an application trusts a client-supplied identifier - here a WordPress plugin object key such as a ticket, order, or attendee ID - to select a database record without re-verifying that the requester owns or is otherwise authorized for that record. Event Tickets is a StellarWP/Liquid Web plugin that extends WordPress with ticketing, RSVP, attendee, and order management, exposing that data through AJAX handlers and REST-style endpoints; such handlers typically rely on capability checks and nonces for authentication while the per-object ownership decision is delegated to a query filter or parameter, which is exactly where this class of bug appears. The CPE/product data available identifies only the WordPress plugin distribution 'Event Tickets' up to and including 5.30.0.1, with no server-side component, so exposure is bounded by whether the plugin is installed and active on a reachable WordPress site. Because the supplied vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, the assessed worst case is unauthenticated network reach with a limited integrity-only effect on the targeted records; no confidentiality or availability loss is claimed.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable IDOR with no special complexity; PR:N retained per source vector though authentication may apply; integrity-only limited impact, so C:N/I:L/A:N.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB