CVE-2026-62047
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Event Tickets plugin (Liquid Web / StellarWP) through 5.30.2 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker may perform actions or access data reserved for authorized users due to insufficient permission checks.
Recommendation
Update the Event Tickets plugin to a version containing the fix. Review and harden access control rules.
Other vulnerabilities in Event Tickets
See all- CVE-2026-110902Medium
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.
- CVE-2026-105893Medium
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables. This issue affects Event Tickets: from n/a through 5.30.0.1.
- CVE-2026-62055Medium
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.
- CVE-2026-105891Medium
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Event Tickets: from n/a through 5.30.0.1.
- CVE-2026-105888Medium
Missing authorization in Event Tickets (up to 5.30.0.1) allows exploiting incorrectly configured access control security levels.
- CVE-2026-104675Medium
Missing authorization in Event Tickets plugin up to version 5.30.0. Allows exploitation of incorrectly configured access control security levels.
- CVE-2026-97287High
The Event Tickets plugin (Liquid Web / StellarWP) is vulnerable to SQL Injection (Blind SQL Injection) due to improper neutralization of special elements in SQL commands. This issue affects Event Tickets from n/a through 5.29.5.
- CVE-2026-93526High
Unauthenticated Cross Site Scripting (XSS) in Event Tickets versions up to 5.29.4.
- CVE-2026-78263High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Event Tickets versions up to and including 5.29.2.1.
- CVE-2026-65567Medium
The Event Tickets plugin version 5.29.0.1 and earlier has a broken access control vulnerability without authentication. An unauthenticated attacker can access functions intended for authorized users.
Original NVD description (English source)
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS