CVE-2026-3174 in Event Tickets and Registration Plugin
Summary
by MITRE • 09/08/2026
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site's Stripe merchant credentials (access tokens, publishable keys, and account ID), diverting all subsequent payment processing to the attacker's Stripe account.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in Event Tickets and Registration versions up through 5.27.4 represents a critical security flaw rooted in insufficient access control mechanisms within the plugin’s integration with the Stripe payment gateway. Specifically, the issue resides in the OAuth return endpoint, which is designed to handle the callback from Stripe after a user authorizes their account for processing payments. In a properly secured implementation, this endpoint must verify that the request originates from an authenticated and authorized administrator who has the specific capability to manage plugin settings or financial configurations. However, due to a missing capability check, the application fails to validate whether the incoming request is associated with a logged-in user possessing administrative privileges. This architectural oversight allows any external actor, regardless of their authentication status on the WordPress site, to interact directly with this sensitive endpoint by crafting specific HTTP requests that mimic legitimate OAuth callbacks.
The technical exploitation of this flaw enables unauthenticated attackers to perform unauthorized data modification against the site’s configuration state. By manipulating the parameters passed during the Stripe OAuth flow, an attacker can force the plugin to accept and store maliciously crafted merchant credentials. These credentials include access tokens, publishable keys, and account identifiers that are essential for establishing a connection between the WordPress site and the Stripe payment processor. Once these values are overwritten in the database or configuration files managed by the plugin, the trust relationship established during normal operation is subverted. The system continues to function normally from the perspective of end-users, but the underlying financial routing has been hijacked without any visible indication to the legitimate administrators.
The operational impact of this vulnerability is severe and directly impacts the integrity of revenue streams for websites relying on Event Tickets and Registration for commerce. By successfully overwriting the Stripe merchant credentials, an attacker effectively diverts all subsequent payment processing transactions away from the legitimate business account and into their own controlled Stripe account. This results in direct financial loss as customers believe they are paying the event organizer or organization, but the funds are instead captured by the malicious actor. Beyond immediate monetary theft, this breach compromises the trust of the customer base and may lead to significant reputational damage for the affected entity. Furthermore, because the attacker controls the payment gateway credentials, they could potentially manipulate transaction records or access sensitive financial data associated with past transactions if additional security layers are not in place.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically highlighting failures to enforce proper authorization checks before allowing actions that modify system state. It also maps to the MITRE ATT&CK framework under techniques related to Account Manipulation and potentially Initial Access if used as part of a broader attack chain where payment diversion serves as a motive for further intrusion or extortion. The lack of authentication requirements on an administrative function is a classic example of broken access control, often resulting from developers assuming that certain endpoints are only accessible through standard user interfaces rather than securing them at the code level against direct API calls.
To mitigate this risk and prevent future occurrences, immediate action must be taken to upgrade Event Tickets and Registration to version 5.27.5 or later, where the missing capability check has been implemented by the developers. For sites that cannot immediately update due to compatibility constraints, temporary mitigations should include restricting access to WordPress admin directories via IP whitelisting if feasible, although this is less effective for cloud-hosted environments with dynamic IPs. Additionally, implementing a Web Application Firewall (WAF) can help detect and block anomalous requests targeting the Stripe OAuth endpoint by analyzing request patterns typical of unauthenticated exploitation attempts. Regular auditing of plugin code for proper use of WordPress capability functions such as current_user_can or similar authorization checks is essential to ensure that all administrative endpoints remain protected against unauthorized modification.