The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own. This vulnerability affects users of the plugin, particularly administrators of WordPress installations wit [truncated]
ReviewEvent Tickets and RegistrationCVE published 2026-08-01
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders. This vulnerability could lead to unauthorized changes in order status, potentially impacting the integrity of event ticket sales and registrations. The CVE record and NVD detail in [truncated]
