CVE-2026-14822

MediumCVSS 5.3

Published: 01/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

The Event Tickets and Registration WordPress plugin before version 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.

Risk Assessment

An attacker can cancel, confirm, or change the status of orders, leading to financial losses, logistical issues, and loss of customer trust.

Recommendation

Update the Event Tickets and Registration plugin to version 5.29.0.1 or later, which adds the required authorization.

Other vulnerabilities in Event Tickets and Registration WordPress plugin

CVE-2026-14823Low
The Event Tickets and Registration WordPress plugin before version 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own.

Original NVD description (English source)

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS