CVE-2026-110902: WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation does not require user interaction and can be performed over the network.

Q: What is the potential impact?

The reported impact is limited to integrity, meaning an attacker may be able to make unauthorized modifications. No confidentiality or availability impact is indicated by the supplied CVSS vector.

Q: Which Event Tickets versions are affected?

Event Tickets versions through 5.30.1 are affected. The affected-version range does not provide a known lower bound.

Published Oct 19, 2026

Updated

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.

Affected Software

1 affected component

Liquid Web / StellarWP Event Tickets<=5.30.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Event Tickets to a version that resolves this vulnerability.
Fixed in 5.30.2

Event History

Oct 19, 2026

CVE Published

via MITRE·01:27 PM

Data Sourced

via MITRE·01:27 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation does not require user interaction and can be performed over the network.

What is the potential impact?

The reported impact is limited to integrity, meaning an attacker may be able to make unauthorized modifications. No confidentiality or availability impact is indicated by the supplied CVSS vector.

Which Event Tickets versions are affected?

Event Tickets versions through 5.30.1 are affected. The affected-version range does not provide a known lower bound.

CVE-2026-110902: WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact?

Which Event Tickets versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact?

Which Event Tickets versions are affected?