CVE-2026-3174: Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site's Stripe merchant credentials (access tokens, publishable keys, and account ID), diverting all subsequent payment processing to the attacker's Stripe account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Event Tickets and Registrationto a version that resolves this vulnerability.Fixed in 5.27.4 - Compensating control
Restrict access to the WordPress Stripe OAuth return endpoint so unauthenticated requests cannot reach the capability-missing handler (only allow authenticated/authorized users).
- Operational
After patching, rotate/reconfigure the site's Stripe credentials (access tokens, publishable keys, and account ID) that may have been overwritten via the Stripe OAuth return endpoint.
Event History
Frequently Asked Questions
Which sites are exposed to payment diversion?
WordPress sites running Event Tickets and Registration version 5.27.4 or earlier are affected. The impact applies to sites that use the plugin's Stripe integration, because the attacker can replace the stored Stripe merchant credentials.
Does exploitation require an account or user interaction?
No. The issue is reachable by an unauthenticated attacker and requires neither privileges nor user interaction.
What can an attacker change after exploiting this issue?
An attacker can overwrite the site's Stripe access tokens, publishable keys, and account ID. Subsequent payments can then be routed to the attacker's Stripe account.
How can administrators determine whether their payment configuration may have been altered?
Review the Stripe merchant credentials configured in the plugin, including the access tokens, publishable keys, and account ID, and verify that they belong to the intended Stripe account. Also review whether subsequent payment processing has been directed to an unexpected Stripe account.