CVE-2026-14823
LowCVSS 2.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Event Tickets and Registration WordPress plugin before version 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own.
Risk Assessment
An attacker can disrupt events of other organizers by altering seat assignments and ticket availability, leading to chaos and potential financial losses.
Recommendation
Update the Event Tickets and Registration plugin to version 5.29.0.1 or later, which includes authorization fixes.
Original NVD description (English source)
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own.