Quick answers
- Is CVE-2026-14823 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14823 being exploited in the wild.
- How severe is CVE-2026-14823?
- Informational severity, with a CVSS score of 2.2, published 1 August 2026.
- Which products and versions are affected?
- The Events Calendar Event Tickets and Registration < 5.29.0.1.
- Is there a fix for CVE-2026-14823?
- A patch was published on 2026-08-01: Fixed in version 5.29.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-14823 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14823?
- Check whether you run The Events Calendar Event Tickets and Registration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Event Tickets and Registration plugin (event-tickets) before version 5.29.0.1 fails to perform adequate authorization checks on specific seating-related actions. This vulnerability is classified as an Insecure Direct Object Reference (IDOR) (CWE-639). An authenticated attacker with at least Contributor-level privileges can exploit this flaw to overwrite seating layouts, ticket inventory counts, and attendee seat assignments for events they do not own. The attack is performed via network requests to vulnerable seating action endpoints. The issue is resolved in version 5.29.0.1.
Affected products
- The Events Calendar Event Tickets and Registration < 5.29.0.1
Timeline
- 2026-07-20: disclosed: Publicly published by WPScan
- 2026-08-01: advisory: CVE published to NVD dataset
- 2026-08-01: patched: Fixed in version 5.29.0.1