Event Tickets and Registration <= 5.30.2 - Unauthenticated Payment Bypass via PayPal Standard Payment Data Tampering
- ID
- WPSEC-2026-2140
- Plugin
- Event Tickets and Registration (event-tickets)
- Affected
- all versions before 5.30.3
- Remediation
- Update to 5.30.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- Event Tickets and Registration on WPSec AttackSurface
- Fix released
- Published
Description
The Event Tickets and Registration plugin for WordPress is vulnerable to insufficient verification of data authenticity in the legacy PayPal Standard payment confirmation in all versions up to, and including, 5.30.2. This is due to payments being fulfilled without checking the amount, currency or receiving merchant against what the checkout sent, and the PDT handler always issuing tickets as completed regardless of the payment status. This makes it possible for unauthenticated attackers to obtain tickets by tampering with the PayPal cart to underpay or pay another merchant, on sites using the legacy PayPal Standard gateway.
References
- https://wpsec.com/vuln/WPSEC-2026-2140/
- https://plugins.svn.wordpress.org/event-tickets/tags/5.30.3/
- https://wordpress.org/plugins/event-tickets/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS