Event Tickets and Registration <= 5.29.5.2 - Authenticated (Contributor+) Missing Authorization to Ticket Creation and Modification via REST API
- ID
- WPSEC-2026-0026
- Plugin
- Event Tickets and Registration (event-tickets)
- Affected
- from 5.26.0 before 5.30.0
- Remediation
- Update to 5.30.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Event Tickets and Registration on WPSec AttackSurface
- Fix released
- Published
Description
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data in versions 5.26.0 up to, and including, 5.29.5.2. This is due to the experimental TEC REST API v1 ticket create and update endpoints only checking the generic capability of the ticket post type (which uses the 'post' capability type) and never checking that the user can edit the event the ticket belongs to. This makes it possible for authenticated attackers, with Contributor-level access and above, to add published tickets with an arbitrary name and price to events they cannot edit, and to change those events' shared ticket capacity. The endpoints are only registered when Tickets Commerce is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0026/
- https://plugins.svn.wordpress.org/event-tickets/tags/5.30.0/
- https://wordpress.org/plugins/event-tickets/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS