# Event Tickets and Registration <= 5.30.2 - Authenticated (Contributor+) Missing Authorization to Moving Tickets and Attendees Between Posts

- **ID:** WPSEC-2026-2138
- **Plugin:** Event Tickets and Registration (`event-tickets`), https://wordpress.org/plugins/event-tickets/
- **Affected versions:** all versions before 5.30.3
- **Fixed in:** 5.30.3 (Update to 5.30.3 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/event-tickets
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2138/

## Description

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 5.30.2. This is due to the ticket type move and attendee move AJAX handlers, and the ticket type listing, relying only on a nonce that is issued to every user with editor access, without checking that the user can edit or manage the attendees of the source and destination posts. This makes it possible for authenticated attackers with Contributor-level access and above to move ticket types and attendees between events they do not own and to list ticket types of other posts.

## References

- https://wpsec.com/vuln/WPSEC-2026-2138/
- https://plugins.svn.wordpress.org/event-tickets/tags/5.30.3/
- https://wordpress.org/plugins/event-tickets/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2138/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.