Quick answers
- Is CVE-2026-42662 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42662 being exploited in the wild.
- How severe is CVE-2026-42662?
- Medium severity, with a CVSS score of 6.5, published 15 June 2026.
- Which products and versions are affected?
- StellarWP Event Tickets <= 5.27.5.
- Is there a fix for CVE-2026-42662?
- A patch was published on 2026-05-02: Patch released in version 5.27.6.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42662 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-42662?
- Check whether you run StellarWP Event Tickets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Event Tickets plugin for WordPress is vulnerable to an authentication bypass by spoofing (CWE-290) in versions up to 5.27.5. This vulnerability allows an unauthenticated remote attacker to bypass intended security restrictions within the plugin's logic. The root cause involves insufficient verification of identity or session state, which can be exploited via network requests without any user interaction. Successful exploitation could allow an attacker to modify data or impact the availability of ticketing services. A patch is available in version 5.27.6.1.
Affected products
- Liquid Web / StellarWP Event Tickets <= 5.27.5
Timeline
- 2026-04-02: other: Reported by researcher endy
- 2026-05-02: disclosed: Initial disclosure by Patchstack
- 2026-05-02: patched: Patch released in version 5.27.6.1
- 2026-06-15: advisory: NVD advisory published