WordPress Plugin Vulnerabilities

Event Tickets and Registration < 5.30.0.1 - Missing Authorization

Description

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 5.30.0. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
event-tickets
Fixed in 5.30.0.1

References

CVE
CVE-2026-104675
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/97204be9-f5a0-45b4-843e-139a545f3e54

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Intrudify
Verified
No
WPVDB ID
c27a5d79-5833-4de7-ad8a-a634c9fa24c0

Timeline

Publicly Published
2026-10-05 (about 12 days ago)
Added
2026-10-08 (about 8 days ago)
Last Updated
2026-10-08 (about 8 days ago)

Other

Published
Title
Published
2025-11-22
Title
Modula Image Gallery < 2.13.7 - Missing Authorization
Published
2026-01-22
Title
Final User <= 1.2.5 - Missing Authorization
Published
2024-03-07
Title
WooCommerce Add to Cart Custom Redirect < 1.2.14 - Authenticated(Contributor+) Missing Authorization to Limited Arbitrary Options Update
Published
2026-09-17
Title
Booking for Appointments and Events Calendar – Amelia (Premium) < 2.4.5 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover
Published
2026-10-02
Title
WDS MCP Content Manager <= 3.10.4 - Missing Authorization