{
 "id": "WPSEC-2026-2437",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2437/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2437/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2437/index.md",
 "title": "Event Tickets and Registration <= 5.30.3 - Unauthenticated Insecure Direct Object Reference via Stripe PaymentIntent ID",
 "description": "The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Stripe PaymentIntent ID in the Tickets Commerce Stripe order and coupon handling in all versions up to, and including, 5.30.3, due to missing validation on a user-controlled key. The plugin did not check that the PaymentIntent was issued to the requesting checkout or cart, that it could still take a payment, or that it was not already bound to another order. This makes it possible for unauthenticated attackers who know another buyer's PaymentIntent ID to bind it to their own order, which returns the intent's client secret and can let an order be completed with a payment that belongs to someone else. Attackers can also change the amount of another buyer's intent by applying a coupon.",
 "plugin": {
  "slug": "event-tickets",
  "name": "Event Tickets and Registration",
  "full_name": "Event Tickets and Registration",
  "wordpress_org": "https://wordpress.org/plugins/event-tickets/",
  "advisories_url": "https://wpsec.com/vuln/plugin/event-tickets/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/event-tickets"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.3.0",
    "from_inclusive": true,
    "to": "5.30.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.3.0 before 5.30.3.1"
  ]
 },
 "introduced_in": "5.3.0",
 "fixed_in": "5.30.3.1",
 "remediation": "Update to 5.30.3.1 or later.",
 "fix_released": "2026-11-02T21:53:42+00:00",
 "published": "2026-11-03T22:43:40+00:00",
 "updated": "2026-11-03T13:19:24.061427+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2437/",
  "https://plugins.svn.wordpress.org/event-tickets/tags/5.30.3.1/",
  "https://wordpress.org/plugins/event-tickets/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/event-tickets",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}