Executive brief
A vulnerability in the Event Tickets and Registration plugin for WordPress allows unauthorized individuals to modify the status of customer orders. This plugin is used by websites to manage event bookings and ticket sales. An attacker could potentially mark unpaid orders as paid or cancel legitimate transactions, leading to financial discrepancies and operational disruption for event organizers.
Technical details
The vulnerability is classified as a Missing Authorization (CWE-284) flaw within an order-management REST API endpoint. Specifically, the plugin fails to verify the permissions of the requester when accessing endpoints related to PayPal order processing. An unauthenticated remote attacker can send crafted HTTP requests to these endpoints to change the status of existing orders. This could be used to bypass payment verification or disrupt business logic. The issue is resolved in version 5.29.0.1.
Affected products
- The Events Calendar Event Tickets and Registration before 5.29.0.1
Timeline
- 2026-07-20: disclosed
- 2026-07-20: patched: Fixed in version 5.29.0.1
- 2026-08-01: advisory