CVE-2026-123129
Received Received - Intake

Unauthenticated Price Manipulation in Event Tickets Manager for WooCommerce

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: WPScan

Description
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next event ticket added to any cart, allowing unauthenticated visitors to buy event tickets at an arbitrary price, including for free. This is due to an incomplete fix of CVE-2026-34898.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-123129
EUVD
EUVD-2026-119832

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Event Tickets Manager for WooCommerce From 1.5.4 (inc) to 1.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Event Tickets Manager for WooCommerce WordPress plugin before version 1.6.0. It allows unauthenticated users to manipulate ticket prices globally by submitting arbitrary prices through an unauthenticated AJAX action. The plugin fails to validate these prices when no ticket types are configured for a product, storing the submitted price site-wide and applying it to all event tickets in any cart.

Detection Guidance

Check the installed version of the Event Tickets Manager for WooCommerce plugin. If it is between 1.5.4 and 1.5.9, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files in the /wp-content/plugins/ directory for version details.

Impact Analysis

Unauthenticated visitors can exploit this flaw to purchase event tickets at any price, including for free. This could lead to financial losses for the website owner due to underpriced or free tickets. Additionally, it may disrupt normal business operations and cause reputational damage.

Mitigation Strategies

Update the Event Tickets Manager for WooCommerce plugin to version 1.6.0 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123129. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...