Unauthorized Data Modification in Event Tickets and Registration Plugin for WordPress

CVE-2026-3174

What is CVE-2026-3174?

The Event Tickets and Registration plugin for WordPress contains a vulnerability that allows unauthorized modification of sensitive data. This issue stems from an absence of capability checks on the Stripe OAuth return endpoint across all versions up to and including 5.27.4. An unauthenticated attacker can exploit this flaw to overwrite the site's Stripe merchant credentials, including access tokens and account identifiers. Consequently, all future payment transactions may be redirected to the attacker's Stripe account, creating significant security risks for affected sites.

References