Event Tickets and Registration <= 5.30.3 - Unauthenticated Insecure Direct Object Reference via Stripe PaymentIntent ID
- ID
- WPSEC-2026-2437
- Plugin
- Event Tickets and Registration (event-tickets)
- Affected
- from 5.3.0 before 5.30.3.1
- Remediation
- Update to 5.30.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- Event Tickets and Registration on WPSec AttackSurface
- Fix released
- Published
Description
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Stripe PaymentIntent ID in the Tickets Commerce Stripe order and coupon handling in all versions up to, and including, 5.30.3, due to missing validation on a user-controlled key. The plugin did not check that the PaymentIntent was issued to the requesting checkout or cart, that it could still take a payment, or that it was not already bound to another order. This makes it possible for unauthenticated attackers who know another buyer's PaymentIntent ID to bind it to their own order, which returns the intent's client secret and can let an order be completed with a payment that belongs to someone else. Attackers can also change the amount of another buyer's intent by applying a coupon.
References
- https://wpsec.com/vuln/WPSEC-2026-2437/
- https://plugins.svn.wordpress.org/event-tickets/tags/5.30.3.1/
- https://wordpress.org/plugins/event-tickets/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS