7.5
High
CVE-2025-11517 The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and…
Description
The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Event Tickets and Registration 5.26 | earliest → 5.26.5 | No fix stated |
| Event Tickets and Registration 5.26 | earliest → 5.26.5 | No fix stated |
Other CVEs of Event Tickets and Registration
The 6 CVEs of Event Tickets and Registration →
CVE-2025-1402
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing…
5.3
Medium
CVE-2024-13457
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all…
5.3
Medium
CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
6.3
Medium
CVE-2024-2261
The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all…
4.3
Medium