CVE-2026-57705
Received Received - Intake

BaseFortify

Publication date: 2026-07-13

Last updated on: 2026-07-13

Assigner: Patchstack

Description
Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-13
Last Modified
2026-07-13
Generated
2026-07-13
AI Q&A
2026-07-13
EPSS Evaluated
N/A
NVD
CVE-2026-57705
EUVD
EUVD-2026-43360

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nexcess event_tickets to 5.28.5 (inc)
nexcess event_tickets From 5.0.0 (inc) to 5.28.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57705 is a Broken Access Control vulnerability in the WordPress Event Tickets Plugin versions 5.28.5 and earlier. It occurs due to missing authorization, authentication, or nonce token checks, allowing unauthenticated users to perform actions that should require higher privileges.

Impact Analysis

This vulnerability allows unauthenticated users to execute higher-privileged actions without proper authorization, which can lead to unauthorized changes or access within affected websites. Although classified as low priority, it poses a risk of mass exploitation potentially impacting thousands of websites.

Detection Guidance

This vulnerability involves missing authorization in the WordPress Event Tickets Plugin versions 5.28.5 and earlier, allowing unauthenticated users to perform higher-privileged actions.

Detection typically involves checking the version of the Event Tickets plugin installed on your WordPress site.

You can detect the vulnerable plugin version by running commands to list installed WordPress plugins and their versions, for example:

  • Using WP-CLI: wp plugin list | grep event-tickets
  • Manually checking the plugin version in the WordPress admin dashboard under Plugins.

Additionally, monitoring web server logs for unauthorized or suspicious access attempts to Event Tickets plugin endpoints may help identify exploitation attempts.

Mitigation Strategies

The immediate mitigation step is to update the WordPress Event Tickets plugin to the patched version 5.28.5.1 or later.

If updating immediately is not possible, users should seek assistance from their hosting provider or developer to apply necessary patches or workarounds.

Patchstack users can enable auto-updates for vulnerable plugins to ensure timely patching.

Additionally, reviewing and tightening access control settings on your WordPress site and monitoring for unusual activity related to the Event Tickets plugin is recommended.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57705. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart