CVE-2026-14822

A Broken Access Control vulnerability exists in the WordPress Event Tickets and Registration plugin in versions prior to 5.29.0.1. An unprotected REST API endpoint handles ticket orders and payment state transitions without enforcing proper authorization checks or payment validation from PayPal IPN/Webhooks.

An unauthenticated attacker can forge requests to modify the status of pending ticket orders to completed, bypassing the checkout payment process and acquiring event passes or modifying ticket statuses arbitrarily.

Event Tickets provides ticketing management with built-in PayPal payment support. The callback handler responsible for updating payment status neglected to check authorization credentials or verify the authenticity of the caller against PayPal transaction tokens.

Consequently, an unauthenticated client could craft direct requests to the endpoint supplying an arbitrary order identifier, updating its status to "completed".

Attack vector: Unauthenticated HTTP POST request to the REST endpoint controlling order status.

• Unauthenticated authorization bypass on paid ticket transactions
• Fraudulent generation and approval of event tickets without payment
• Tampering with event registration records and inventory

Update Event Tickets to version 5.29.0.1 or later. The security patch enforces strict verification on order status callbacks and requires verified webhook signatures.