CVE-2026-125827: WordPress Event Tickets plugin <= 5.31.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.31.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.31.1
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates it can be exploited remotely without authentication or user interaction. The available data does not identify any additional attacker requirements.
What is the impact of successful exploitation?
The listed impact is limited confidentiality impact, with no integrity or availability impact indicated. The description attributes the issue to missing authorization and incorrectly configured access-control security levels.
Which versions are affected?
Event Tickets versions through 5.31.0 are affected. The available data does not identify a fixed version.