Event Tickets and Registration <= 5.29.5.1 - Unauthenticated Business Logic Error to Seat Overbooking via Duplicate Reservation IDs
- ID
- WPSEC-2026-0027
- Plugin
- Event Tickets and Registration (event-tickets)
- Affected
- from 5.16.0 before 5.29.5.2
- Remediation
- Update to 5.29.5.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-837
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Event Tickets and Registration on WPSec AttackSurface
- Fix released
- Published
Description
The Event Tickets and Registration plugin for WordPress is vulnerable to a business logic flaw in its Assigned Seating reservation handling in versions 5.16.0 up to, and including, 5.29.5.1. The tec_tickets_seating_post_reservations AJAX action, which is open to unauthenticated visitors, did not ensure that each seat reservation held by the seating service backs only one ticket: before 5.29.5.1 the posted reservations were stored without being checked against the service at all, and in 5.29.5.1 a held reservation that had already been matched was not consumed, so the same reservation ID could be repeated. Because the cart allows as many seated tickets as the session lists reservations, this makes it possible for unauthenticated attackers to buy more seated tickets than the seats they actually hold, issuing several attendees for a single seat and leaving the ticket stock out of step with the seating map. Exploitation requires the Assigned Seating feature to be in use.
References
- https://wpsec.com/vuln/WPSEC-2026-0027/
- https://plugins.svn.wordpress.org/event-tickets/tags/5.29.5.2/
- https://wordpress.org/plugins/event-tickets/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS