CVE-2026-123129: Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Ticket Price Manipulation
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next event ticket added to any cart, allowing unauthenticated visitors to buy event tickets at an arbitrary price, including for free.
This is due to an incomplete fix of CVE-2026-34898.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Event Tickets Manager for WooCommerceto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
What configuration condition makes this exploitable?
The unauthenticated AJAX action is vulnerable when the product referenced by the request has no ticket types configured. In that condition, the plugin does not validate the submitted ticket-type price.
Does an attacker need a WordPress or WooCommerce account?
No. The affected AJAX action is unauthenticated, so an unauthenticated visitor can submit an arbitrary price, including zero.
What is the scope of a successful price change?
The submitted price is stored site-wide rather than being limited to the attacker’s request. It is applied to the next event ticket added to any cart.
Which versions should be treated as affected?
Versions before 1.6.0 are affected. The listed affected range includes 1.5.4 through 1.5.9.