7.5
Élevée
CVE-2025-11517 The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and…
Description
The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Event Tickets and Registration 5.26 | premières → 5.26.5 | Pas de correctif indiqué |
| Event Tickets and Registration 5.26 | premières → 5.26.5 | Pas de correctif indiqué |
Autres CVE de Event Tickets and Registration
Les 6 CVE de Event Tickets and Registration →
CVE-2025-1402
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing…
5.3
Moyenne
CVE-2024-13457
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all…
5.3
Moyenne
CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
6.3
Moyenne
CVE-2024-2261
The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all…
4.3
Moyenne