CVE-2026-104675 Liquid Web / StellarWP CVE debrief

Who should care

Defenders and administrators using the Event Tickets plugin, especially in environments with complex user roles and permissions, should assess their exposure and verify the configuration of access control security levels.

Why it matters

Defenders should care about CVE-2026-104675 because it affects the Event Tickets plugin, allowing for Exploiting Incorrectly Configured Access Control Security Levels, which requires verification of access control configurations and user roles.

• Verification of access control security levels is required to prevent potential unauthorized actions
• Defenders need to review user roles and permissions in environments where the plugin is used

Technical summary

The Event Tickets plugin has a Missing Authorization vulnerability, allowing for Exploiting Incorrectly Configured Access Control Security Levels. This issue affects versions from n/a through 5.30.0 and has a CVSS score of 4.3. The vulnerability requires verification of access control configurations and user roles in environments where the plugin is used, especially in complex user role settings.

Defensive priority

Defenders should prioritize verifying the configuration of access control security levels for the Event Tickets plugin, especially in environments where user roles and permissions are complex.

Recommended defensive actions

• Verify the configuration of access control security levels for the Event Tickets plugin
• Review user roles and permissions in environments where the plugin is used
• Consider upgrading to a version beyond 5.30.0 if available

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being the Patchstack database. The vulnerability affects the Event Tickets plugin, allowing for Exploiting Incorrectly Configured Access Control Security Levels. The CVE record was published on 2026-10-05T09:17:09.030Z and has not been modified since then. The NVD entry and CVE Program record offer additional context but do not provide further details on the vulnerability's impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.