Is CVE-2026-65567 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65567 being exploited in the wild.

How severe is CVE-2026-65567?

Medium severity, with a CVSS score of 5.3, published 27 July 2026.

Which products and versions are affected?

StellarWP Event Tickets <= 5.29.0.1.

Is there a fix for CVE-2026-65567?

A patch was published on 2026-07-27: Version 5.29.1 confirmed as patched version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65567 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65567?

Check whether you run StellarWP Event Tickets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65567: Nexcess Event Tickets broken access control

Q: Is there a fix for CVE-2026-65567?

A patch was published on 2026-07-27: Version 5.29.1 confirmed as patched version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-65567 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-65567?

Check whether you run StellarWP Event Tickets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65567 · Severity: medium · CVSS 5.3 · Published 2026-07-27

Event Tickets is a popular WordPress plugin used to manage event registrations and ticket sales. A security flaw in versions up to 5.29.0.1 allows unauthorized individuals to perform actions that should be restricted to administrators or specific users. While the impact is considered moderate, it could allow attackers to interfere with event management or ticket data without needing a password.

Technologies: StellarWP Event Tickets. Vendors: StellarWP.

Quick answers

Is CVE-2026-65567 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65567 being exploited in the wild.
How severe is CVE-2026-65567?: Medium severity, with a CVSS score of 5.3, published 27 July 2026.
Which products and versions are affected?: StellarWP Event Tickets <= 5.29.0.1.
Is there a fix for CVE-2026-65567?: A patch was published on 2026-07-27: Version 5.29.1 confirmed as patched version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65567 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65567?: Check whether you run StellarWP Event Tickets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Event Tickets plugin for WordPress is vulnerable to broken access control (CWE-862) in versions up to and including 5.29.0.1. The vulnerability stems from a missing authorization check in a function that allows unauthenticated users to execute actions that should require higher privileges. An attacker can exploit this over the network without any user interaction or prior authentication. The impact is primarily on integrity, allowing unauthorized modifications. The issue is resolved in version 5.29.1.

Affected products

Nexcess / StellarWP / Liquid Web Event Tickets <= 5.29.0.1

Timeline

2026-07-16: disclosed: Reported by Ananda Dhakal via Patchstack
2026-07-24: advisory: Patchstack advisory published
2026-07-27: advisory: NVD published CVE-2026-65567
2026-07-27: patched: Version 5.29.1 confirmed as patched version

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.