Event Tickets and Registration vulnerabilities

2 known vulnerabilities in Event Tickets and Registration from StellarWP. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Event Tickets and Registration: Missing Authorization

  CVE-2026-3174Sep 8, 2026StellarWP

  The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenti

• 7.5 High severity

  Event Tickets and Registration: Authorization Bypass Through User-Controlled Key

  CVE-2025-11517Oct 18, 2025StellarWP

  The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allo