CVE-2026-121857: Event Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend

Q: Which users can exploit this issue?

Any WordPress role that has been granted access to the plugin's admin area can exploit it, including Subscriber-level users. The affected plugin versions do not verify that the user is allowed to manage WooCommerce orders.

Q: What information or actions are exposed?

An authorized plugin-admin-area user can retrieve ticket codes and names belonging to customers on arbitrary orders. The same access can be used to remove tickets from those orders.

Q: Is a standard Subscriber account affected by default?

The issue applies to Subscribers only if an administrator has granted that role access to the Event Tickets with Ticket Scanner admin area. The provided information does not indicate that such access is enabled by default.

Q: What can be done before updating?

Remove plugin admin-area access from untrusted or unnecessary roles and users, especially Subscriber accounts. Limit access to users who should be permitted to manage WooCommerce order-related ticket data.

Published Nov 7, 2026

Updated

The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Event Tickets with Ticket Scanner to a version that resolves this vulnerability.
Fixed in 3.1.14

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Which users can exploit this issue?

Any WordPress role that has been granted access to the plugin's admin area can exploit it, including Subscriber-level users. The affected plugin versions do not verify that the user is allowed to manage WooCommerce orders.

What information or actions are exposed?

An authorized plugin-admin-area user can retrieve ticket codes and names belonging to customers on arbitrary orders. The same access can be used to remove tickets from those orders.

Is a standard Subscriber account affected by default?

The issue applies to Subscribers only if an administrator has granted that role access to the Event Tickets with Ticket Scanner admin area. The provided information does not indicate that such access is enabled by default.

What can be done before updating?

Remove plugin admin-area access from untrusted or unnecessary roles and users, especially Subscriber accounts. Limit access to users who should be permitted to manage WooCommerce order-related ticket data.

CVE-2026-121857: Event Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

What information or actions are exposed?

Is a standard Subscriber account affected by default?

What can be done before updating?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What information or actions are exposed?

Is a standard Subscriber account affected by default?

What can be done before updating?