Event Tickets and Registration <= 5.30.2 - Authenticated (Contributor+) Missing Authorization to Moving Tickets and Attendees Between Posts
- ID
- WPSEC-2026-2138
- Plugin
- Event Tickets and Registration (event-tickets)
- Affected
- all versions before 5.30.3
- Remediation
- Update to 5.30.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- Event Tickets and Registration on WPSec AttackSurface
- Fix released
- Published
Description
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 5.30.2. This is due to the ticket type move and attendee move AJAX handlers, and the ticket type listing, relying only on a nonce that is issued to every user with editor access, without checking that the user can edit or manage the attendees of the source and destination posts. This makes it possible for authenticated attackers with Contributor-level access and above to move ticket types and attendees between events they do not own and to list ticket types of other posts.
References
- https://wpsec.com/vuln/WPSEC-2026-2138/
- https://plugins.svn.wordpress.org/event-tickets/tags/5.30.3/
- https://wordpress.org/plugins/event-tickets/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS