Authorization Bypass in Event Tickets and Registration Plugin by WordPress
CVE-2026-14823
Currently unrated
What is CVE-2026-14823?
The Event Tickets and Registration plugin for WordPress versions before 5.29.0.1 is susceptible to an authorization bypass issue. This flaw allows users with contributor-level access and higher privileges to manipulate seating arrangements, adjust ticket inventory, and reassign attendee seating for events that they do not own. This vulnerability can lead to significant disruptions in event management and improper handling of ticket sales.
Affected Version(s)
Event Tickets and Registration 0 < 5.29.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.