CVE-2026-57705
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The Event Tickets plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.28.5.
Risk Assessment
An attacker may gain unauthorized access to functions or data managed by the plugin, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to immediately update the Event Tickets plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Event Tickets
See all- CVE-2026-65567Medium
The Event Tickets plugin version 5.29.0.1 and earlier has a broken access control vulnerability without authentication. An unauthenticated attacker can access functions intended for authorized users.
- CVE-2026-78263High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Event Tickets versions up to and including 5.29.2.1.
- CVE-2026-42662Medium
Event Tickets versions up to 5.27.5 contain a vulnerability that allows unauthenticated bypass of security measures.
Original NVD description (English source)
Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.