CVE-2026-104675 in Event Tickets Plugin
Summary
by MITRE • 10/05/2026
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The identified security flaw represents a critical failure in access control mechanisms within the Event Tickets plugin for WordPress, specifically affecting versions ranging from initial releases up to version 5.30.0 distributed by Liquid Web and StellarWP. This vulnerability is classified as an authorization bypass or broken access control issue, where the application fails to properly verify whether an authenticated user has the necessary permissions to perform specific actions on resources they do not own or are not authorized to manage. In a typical WordPress environment, this often manifests when endpoints handling ticket creation, modification, deletion, or attendee management fail to validate that the requesting user ID matches the owner of the event or possesses administrative privileges required for such operations. The absence of these checks allows any authenticated attacker with even minimal access levels, such as subscribers or contributors who might otherwise have limited capabilities, to escalate their privileges and manipulate ticket data arbitrarily.
From a technical perspective, this flaw stems from insufficient server-side validation of user roles and resource ownership during API requests or form submissions related to event tickets. When an application relies solely on client-side restrictions for security decisions without enforcing them at the backend logic layer, it creates a significant gap that can be exploited by crafting malicious HTTP requests with modified parameters. An attacker could manipulate request payloads to target events belonging to other users or administrators, effectively bypassing intended role-based access controls. This type of vulnerability aligns closely with CWE-284 Improper Access Control and is frequently associated with the ATT&CK technique T1078 Valid Accounts, as it leverages legitimate credentials to perform unauthorized actions that should be restricted by policy. The impact extends beyond simple data manipulation; because Event Tickets handles sensitive attendee information including names, email addresses, and potentially payment details, an attacker could exfiltrate personally identifiable information or disrupt event operations by deleting critical ticket records.
The operational impact of this vulnerability is severe for organizations relying on the plugin to manage events and sell tickets online. Unauthorized access allows malicious actors to alter pricing structures, cancel registrations, or inject fraudulent entries into attendee lists, leading to direct financial loss and reputational damage. Furthermore, if an attacker gains control over administrative functions through privilege escalation facilitated by these weak authorization checks, they could potentially compromise the entire WordPress installation, especially if combined with other vulnerabilities such as cross-site scripting or SQL injection that might exist in related components. The lack of proper logging for unauthorized access attempts also hinders incident response efforts, making it difficult to detect ongoing exploitation campaigns without proactive monitoring tools.
To mitigate this risk, immediate action is required by upgrading the Event Tickets plugin to a version newer than 5.30.0 where these authorization checks have been corrected and enforced at the server level. Administrators should ensure that all plugins are kept up-to-date with the latest security patches provided by StellarWP and Liquid Web. In addition to updating, implementing strict role-based access control policies within WordPress is advisable, ensuring that users only retain permissions necessary for their specific roles. Enabling comprehensive audit logging can help detect anomalous behavior indicative of exploitation attempts, such as frequent requests from low-privilege accounts attempting to modify high-value resources. Finally, deploying a web application firewall with rules tuned to block common patterns associated with broken access control attacks provides an additional layer of defense against automated scanning and manual exploitation efforts targeting this vulnerability.