SQL Injection Vulnerability in Event Tickets and Registration Plugin for WordPress
CVE-2026-97634

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Event Tickets And Registration
Vendor
CVE Published:
2 October 2026

What is CVE-2026-97634?

The Event Tickets and Registration plugin for WordPress is exposed to a SQL Injection flaw that allows authenticated users with contributor-level access or higher to manipulate SQL queries via the 'orderby' parameter. This vulnerability arises from inadequate escaping of user-supplied input and insufficient preparation in the SQL query, enabling attackers to potentially execute additional SQL statements. Affected users can exploit this path by invoking a post ID they authored, taking advantage of the can_access_page() controls, which only consider post authorship to grant access, rather than requiring more secure permissions such as edit_others_posts.

Affected Version(s)

Event Tickets and Registration 0 <= 5.29.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/event-tickets/...
https://plugins.trac.wordpress.org/browser/event-tickets/...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.