Payment Bypass Vulnerability in Event Tickets and Registration Plugin for WordPress
CVE-2025-11517
7.5HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 18 October 2025
What is CVE-2025-11517?
The Event Tickets and Registration plugin for WordPress has a flaw that allows unauthenticated users to exploit the /wp-json/tribe/tickets/v1/commerce/free/order endpoint. This endpoint fails to verify if a ticket type is legitimately free, enabling malicious actors to circumvent payment processes and gain unauthorized access to paid tickets. This vulnerability presents a significant revenue loss risk for the affected entities.
Affected Version(s)
Event Tickets and Registration * <= 5.26.5