CVE-2026-14822

Received Received - Intake

Unauthenticated Order Status Change in Event Tickets WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-05

Assigner: WPScan

Description

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-01

Last Modified

2026-08-05

Generated

2026-08-21

AI Q&A

2026-08-01

EPSS Evaluated

2026-08-20

NVD

CVE-2026-14822

EUVD

EUVD-2026-51709

Affected Vendors & Products

Vendor	Product	Version / Range
moderntribe	event_tickets_and_registration	to 5.29.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Event Tickets and Registration WordPress plugin before version 5.29.0.1. It allows unauthenticated users to change the status of existing orders by exploiting a missing authorization check on an order-management REST endpoint.

Detection Guidance

To detect this vulnerability, check WordPress sites using the Event Tickets and Registration plugin before version 5.29.0.1. Look for unauthorized order status changes in logs or database entries. No specific commands are provided in the context.

Impact Analysis

Unauthenticated attackers could modify order statuses, potentially leading to unauthorized refunds, order cancellations, or other unintended changes to transaction states. This could disrupt business operations and financial records.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized changes to order data, which may include personal or sensitive information. Such unauthorized modifications could violate data integrity requirements under GDPR and HIPAA.

Mitigation Strategies

Update the Event Tickets and Registration WordPress plugin to version 5.29.0.1 or later to address the authorization flaw.

Hi! I’m here to help you understand CVE-2026-14822. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70