CVE-2026-105893 in Event Tickets Plugin
Summary
by MITRE • 10/08/2026
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The identified vulnerability represents a critical authorization bypass within the Event Tickets plugin, specifically affecting versions ranging from initial releases up to version 5.30.0.1 distributed by Liquid Web and StellarWP. This flaw stems from an insecure implementation of access control mechanisms where the application fails to properly validate or sanitize user-supplied input that serves as a key for data retrieval or modification operations. In typical web applications, keys are often used to identify specific resources such as tickets, orders, or attendee records. When these keys are directly derived from user-controlled variables without adequate server-side verification against authorized access rights, an attacker can manipulate the variable values to reference objects belonging to other users or administrative entities that they should not have permission to view or alter.
From a technical perspective, this vulnerability aligns with CWE-284 Improper Access Control and more specifically CWE-639 Authorization Bypass Through User-Controlled Key. The core issue lies in the reliance on client-side trust for identifying resources rather than enforcing strict server-side authorization checks based on session context or user roles. By altering the key parameter, typically found within HTTP request parameters such as query strings or POST data, an attacker can bypass intended security boundaries. This allows them to perform actions like viewing private ticket details of other attendees, modifying order statuses without proper permissions, or potentially extracting sensitive personal information associated with event registrations that are meant to be restricted to the rightful owner or administrative staff only.
The operational impact of this vulnerability is significant for organizations relying on Event Tickets for managing events and attendee data. Successful exploitation could lead to a breach of confidentiality regarding personally identifiable information (PII) such as names, email addresses, and payment details associated with ticket holders. Furthermore, it may allow attackers to disrupt business operations by altering or canceling tickets belonging to other participants, leading to financial loss and reputational damage for the event organizers. In severe cases, if combined with other vulnerabilities like cross-site scripting or SQL injection facilitated by similar input handling flaws, the risk escalates to full system compromise or large-scale data exfiltration.
In terms of threat modeling, this vulnerability maps to MITRE ATT&CK techniques related to Privilege Escalation and Collection via Client-Side Injection if the manipulation occurs in a browser context, though it primarily falls under lateral movement or unauthorized access patterns where an attacker exploits weak identity verification mechanisms. The lack of robust input validation on critical identifiers means that standard web application firewalls may not detect this abuse unless specifically tuned to look for parameter tampering indicative of IDOR (Insecure Direct Object Reference) attacks.
To mitigate this risk, immediate action is required by upgrading the Event Tickets plugin to a version later than 5.30.0.1 where these authorization checks have been hardened. For environments unable to upgrade immediately due to compatibility constraints, administrators should implement strict server-side validation for all resource identifiers passed through user-controlled inputs. This includes verifying that the requesting user has explicit ownership or administrative rights over the specific ticket ID or order key being accessed. Additionally, implementing rate limiting and monitoring logs for unusual patterns of parameter manipulation can help detect attempted exploitation in real-time. Regular security audits focusing on access control logic are essential to prevent similar authorization bypasses across other modules within the WordPress ecosystem.