CVE-2026-57400

MediumCVSS 6.5

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

The Event Tickets Manager for WooCommerce plugin (versions up to 1.5.5) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This flaw enables an attacker to gain unauthorized access to ticket management functions.

Risk Assessment

The organization is at risk of unauthorized modifications or data leakage related to tickets, potentially compromising the booking system's integrity and customer trust.

Recommendation

Immediately update the Event Tickets Manager for WooCommerce plugin to a version newer than 1.5.5, which includes a fix for the missing authorization issue.

Other vulnerabilities in Event Tickets Manager for WooCommerce

CVE-2026-34898High
There is an unauthenticated broken access control in Event Tickets Manager for WooCommerce versions <= 1.5.3.

Original NVD description (English source)

Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets Manager for WooCommerce: from n/a through <= 1.5.5.