# Event Tickets and Registration <= 5.30.2 - Unauthenticated Payment Bypass via PayPal Standard Payment Data Tampering

- **ID:** WPSEC-2026-2140
- **Plugin:** Event Tickets and Registration (`event-tickets`), https://wordpress.org/plugins/event-tickets/
- **Affected versions:** all versions before 5.30.3
- **Fixed in:** 5.30.3 (Update to 5.30.3 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/event-tickets
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2140/

## Description

The Event Tickets and Registration plugin for WordPress is vulnerable to insufficient verification of data authenticity in the legacy PayPal Standard payment confirmation in all versions up to, and including, 5.30.2. This is due to payments being fulfilled without checking the amount, currency or receiving merchant against what the checkout sent, and the PDT handler always issuing tickets as completed regardless of the payment status. This makes it possible for unauthenticated attackers to obtain tickets by tampering with the PayPal cart to underpay or pay another merchant, on sites using the legacy PayPal Standard gateway.

## References

- https://wpsec.com/vuln/WPSEC-2026-2140/
- https://plugins.svn.wordpress.org/event-tickets/tags/5.30.3/
- https://wordpress.org/plugins/event-tickets/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2140/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.