Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Event Tickets plugin can expose private event details

CVE-2026-105888 · published 27 days ago
Summary

The WordPress Event Tickets plugin (versions up to 5.30.0.1) does not properly check who is allowed to see certain information. As a result, someone without the right permissions could view or change event data that should be private. Install the latest plugin version or apply the vendor's patch as soon as possible to restore proper access controls.

What to do
  • Update liquid web / stellarwp event tickets to version 5.30.0.2.
Affected software
VendorProductAffected versions
liquid web / stellarwp event tickets <= 5.30.0.1
Fix: upgrade to 5.30.0.2
Original advisory text
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published8 Oct 2026
Updated3 Nov 2026
First seen8 Oct 2026
Sources
CVE-2026-105888 · NVD
CVE-2026-105888 · MITRE
Track software like this
Free during beta