# CVE-2026-3174: Event Tickets and Registration Stripe OAuth endpoint capability check bypass

Source: https://junglewise.ai/threats/cve-2026-3174-event-tickets-and-registration-stripe-oauth-endpoint-capability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-3174 · Severity: high · CVSS 7.5 · Published 2026-09-08

Event Tickets and Registration is a popular WordPress plugin for managing event bookings and payments. An unauthenticated attacker can bypass security controls on the Stripe payment integration endpoint, allowing them to overwrite the site's Stripe merchant credentials and redirect all customer payments to their own account—causing immediate financial loss and potential customer data exposure.

Technologies: [The Events Calendar Event Tickets and Registration](https://junglewise.ai/threats/technologies/event-tickets-and-registration). Vendors: [The Events Calendar](https://junglewise.ai/threats/vendors/the-events-calendar).

## Quick answers

**Is CVE-2026-3174 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3174 being exploited in the wild.

**How severe is CVE-2026-3174?** High severity, with a CVSS score of 7.5, published 8 September 2026.

**Which products and versions are affected?** The Events Calendar Event Tickets and Registration up to and including 5.27.4.

**Is there a fix for CVE-2026-3174?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-3174 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-3174?** Check whether you run The Events Calendar Event Tickets and Registration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin contains a missing capability check on the Stripe OAuth return endpoint (REST_Return_Endpoint.php), allowing unauthenticated attackers to submit requests that overwrite Stripe merchant credentials including access tokens, publishable keys, and account ID. The vulnerability affects all versions up to and including 5.27.4. Attack preconditions are minimal—only network access to the WordPress site is required; no authentication or user interaction is needed. An attacker exploiting this flaw can fully compromise payment processing by routing transactions to their own Stripe account. A patch should be available in a version after 5.27.4.

## Affected products

- The Events Calendar Event Tickets and Registration up to and including 5.27.4

## Timeline

- 2026-09-08: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/event-tickets/trunk/src/Tickets/Commerce/Gateways/Stripe/Merchant.php](https://plugins.trac.wordpress.org/browser/event-tickets/trunk/src/Tickets/Commerce/Gateways/Stripe/Merchant.php)
- [https://plugins.trac.wordpress.org/browser/event-tickets/trunk/src/Tickets/Commerce/Gateways/Stripe/REST/Return_Endpoint.php](https://plugins.trac.wordpress.org/browser/event-tickets/trunk/src/Tickets/Commerce/Gateways/Stripe/REST/Return_Endpoint.php)

## Related threats

- [Event Tickets and Registration information disclosure in attendee REST API](https://junglewise.ai/threats/cve-2026-122087-the-event-tickets-and-registration-wordpress-plugin-before-5-30)
- [Event Tickets and Registration information disclosure via REST API](https://junglewise.ai/threats/cve-2026-122061-the-event-tickets-and-registration-wordpress-plugin-before-5-30)
- [Event Tickets and Registration IDOR in seating actions](https://junglewise.ai/threats/cve-2026-14823-event-tickets-and-registration-idor-in-seating-actions)
- [The Events Calendar Event Tickets stored XSS in ticket history log](https://junglewise.ai/threats/cve-2026-14819-the-events-calendar-event-tickets-stored-xss-in-ticket-history)