CVE-2026-14823 Event Tickets and Registration CVE debrief

Who should care

Users of the Event Tickets and Registration WordPress plugin, administrators of WordPress installations with this plugin, and security teams responsible for vulnerability management and monitoring.

Technical summary

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own. This issue is particularly concerning for administrators of WordPress installations with this plugin, as it could allow unauthorized modifications to event management. The vulnerability highlights the importance of proper authorization checks in event management plugins. Evidence is limited; verify plugin version and user access levels.

Defensive priority

Apply vendor patch or upgrade to version 5.29.0.1 or later.

Recommended defensive actions

• Apply vendor patch or upgrade to version 5.29.0.1 or later
• Restrict user access to event management
• Monitor event ticket and registration functionality
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own. Evidence is limited; verify plugin version and user access levels. Limited source detail available. Defenders should verify affected scope, and review context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.