CVE-2026-123129 in Event Tickets Manager for WooCommerce Plugin
Summary
by MITRE • 11/09/2026
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next event ticket added to any cart, allowing unauthenticated visitors to buy event tickets at an arbitrary price, including for free.
This is due to an incomplete fix of CVE-2026-34898.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/09/2026
The Event Tickets Manager plugin for WooCommerce, prior to version 1.6.0, contains a critical insecure direct object reference vulnerability within its unauthenticated AJAX endpoints. This flaw specifically manifests when the referenced product lacks any pre-configured ticket types. In such scenarios, the application fails to validate or sanitize the price parameter submitted by the client during an AJAX request. Instead of rejecting the malformed input or falling back to a default secure value, the system accepts the arbitrary numeric value provided in the request payload and persists it into the global site configuration. This behavior represents a significant deviation from expected security controls for handling financial data within e-commerce platforms.
The operational impact of this vulnerability is severe, as it allows unauthenticated attackers to manipulate transaction values across the entire WooCommerce store. By exploiting this flaw, an attacker can set the price of event tickets to any arbitrary amount, including zero dollars. This effectively enables unauthorized users to purchase event tickets for free or at heavily discounted rates without possessing valid credentials or undergoing proper authentication processes. The persistence of this manipulated price means that subsequent ticket purchases by legitimate customers may also be affected if they interact with carts containing similar product configurations, potentially leading to widespread revenue loss and financial fraud against the business operator.
This issue is categorized under CWE-20 Improper Input Validation within standard vulnerability classification frameworks. It specifically relates to CWE-862 Missing Authorization, as unauthenticated users are able to perform actions that should require higher privilege levels or strict input validation. Furthermore, this exploitation technique aligns with ATT&CK tactic T1190 Exploit Public-Facing Application and the specific sub-technique of manipulating client-side inputs to affect server-side logic. The vulnerability stems from an incomplete remediation effort related to CVE-2026-34898, indicating that previous patches failed to fully address the underlying input validation gaps in this particular code path involving unconfigured ticket types and AJAX price submissions.
To mitigate this risk, administrators must immediately upgrade the Event Tickets Manager plugin to version 1.6.0 or later, where these input validation checks have been properly implemented. Until an update is applied, it is advisable to restrict access to WordPress admin-ajax.php using web application firewall rules that block unauthenticated POST requests containing suspicious price parameters for known vulnerable endpoints. Additionally, implementing strict server-side validation logic that verifies ticket prices against predefined product metadata before processing any transaction can provide a temporary layer of defense. Regular security audits and penetration testing focusing on e-commerce checkout flows are recommended to detect similar input handling flaws in other plugins or custom code within the WordPress environment.