WordPress Plugin Vulnerabilities

Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation

Description

The plugin does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.

Proof of Concept

Affects Plugins

Plugin icon
event-tickets
Fixed in 5.29.0.1

References

CVE
CVE-2026-14822

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Md. Minaruzzaman Shovon
Submitter
Md. Minaruzzaman Shovon
Submitter website
https://shovon.bd/
Verified
Yes
WPVDB ID
ec32cf58-9fc0-4817-8492-92d80be74ef4

Timeline

Publicly Published
2026-07-20 (about 13 days ago)
Added
2026-07-20 (about 12 days ago)
Last Updated
2026-07-22 (about 10 days ago)

Other

Published
Title
Published
2022-05-18
Title
JupiterX < 2.0.7 & JupiterX Core < 2.0.7 - Subscriber+ Arbitrary Plugin Deactivation and Settings Update
Published
2021-03-23
Title
Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation
Published
2021-04-20
Title
Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Plugin Installation
Published
2024-08-26
Title
NitroPack < 1.16.8 - Unauthenticated Arbitrary Shortcode Execution
Published
2021-10-13
Title
Brizy 1.0.127 - 2.3.11 - Incorrect Authorization to Post Modification