5.3
Medium
CVE-2024-13457 The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all…
Description
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the tc-order-id parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view order details of orders they did not place, which includes ticket prices, user emails and order date.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Event Tickets and Registration 5.18 | earliest → 5.18.1 | No fix stated |
| Event Tickets and Registration 5.18 | earliest → 5.18.1 | No fix stated |
Other CVEs of Event Tickets and Registration
The 6 CVEs of Event Tickets and Registration →
CVE-2025-11517
The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and…
7.5
High
CVE-2025-1402
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing…
5.3
Medium
CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
6.3
Medium
CVE-2024-2261
The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all…
4.3
Medium