CVE-2026-104675 Overview
CVE-2026-104675 is a missing authorization vulnerability in the Liquid Web / StellarWP event-tickets plugin for WordPress. The flaw stems from incorrectly configured access control security levels and affects all versions up to and including 5.30.0. An authenticated attacker with low privileges can abuse exposed functionality that lacks proper capability checks. The weakness is tracked as [CWE-862: Missing Authorization].
Critical Impact
Authenticated users with low-level privileges can access or modify plugin functionality intended for higher-privileged roles, leading to limited integrity impact on affected WordPress sites.
Affected Products
- StellarWP Event Tickets plugin for WordPress
- Versions from unspecified initial release through 5.30.0
- WordPress sites running the vulnerable event-tickets plugin
Discovery Timeline
- 2026-10-05 - CVE-2026-104675 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-104675
Vulnerability Analysis
The vulnerability resides in the Event Tickets plugin's access control implementation. One or more plugin endpoints or actions fail to verify that the requesting user holds the required WordPress capability before executing privileged operations. This is a classic broken access control pattern in WordPress plugins, where nonce checks may be present but capability validation is missing or misconfigured.
The attack requires network access and valid authentication at a low privilege level, such as subscriber or customer. No user interaction is needed beyond issuing the malicious request. Successful exploitation produces limited integrity impact without affecting confidentiality or availability of the host system.
Root Cause
The root cause is the absence of a proper current_user_can() capability check, or the use of an insufficient capability level, on functionality that should be restricted to administrators or event organizers. The Patchstack advisory classifies this as broken access control resulting from incorrectly configured access control security levels.
Attack Vector
An authenticated attacker sends crafted HTTP requests to the vulnerable plugin endpoint. Because the handler does not confirm the user's role or capability, the request executes with the attacker's authenticated session, allowing modification of resources normally reserved for higher-privileged roles. See the Patchstack Vulnerability Report for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-104675
Indicators of Compromise
- Unexpected modifications to Event Tickets configurations, ticket records, or attendee data performed by low-privileged WordPress accounts.
- WordPress audit log entries showing low-role users (subscriber, customer) invoking Event Tickets AJAX actions or REST endpoints.
- Anomalous POST requests to admin-ajax.php or /wp-json/tribe/tickets/ routes originating from non-administrative sessions.
Detection Strategies
- Review WordPress access logs for authenticated requests to Event Tickets endpoints correlated against the acting user's role.
- Deploy a WordPress security plugin or Web Application Firewall rule that flags Event Tickets requests from users lacking manage_options or event management capabilities.
- Compare the installed plugin version against 5.30.0 across all managed WordPress instances.
Monitoring Recommendations
- Ingest WordPress and web server logs into a centralized SIEM to correlate low-privilege session activity against sensitive plugin endpoints.
- Alert on bulk ticket, attendee, or order modifications performed outside normal administrator sessions.
- Monitor plugin file integrity and configuration changes on WordPress hosts.
How to Mitigate CVE-2026-104675
Immediate Actions Required
- Update the Event Tickets plugin to a version later than 5.30.0 once the vendor releases a patched build.
- Audit all WordPress user accounts and remove unnecessary low-privileged accounts that could be abused for authenticated exploitation.
- Enforce strong authentication and multi-factor authentication for all WordPress users, including subscribers and customers.
Patch Information
The Patchstack advisory lists Event Tickets 5.30.0 as the last confirmed vulnerable version. Administrators should consult the Patchstack Vulnerability Report and the StellarWP plugin changelog for the fixed release and apply it as soon as it becomes available.
Workarounds
- Restrict access to WordPress authenticated endpoints with a Web Application Firewall rule blocking Event Tickets actions from non-administrative roles.
- Temporarily deactivate the Event Tickets plugin if no business-critical events depend on it until a patched version is deployed.
- Limit new user registrations or require manual approval to reduce the pool of authenticated accounts available to attackers.
# Example: use WP-CLI to check installed Event Tickets version
wp plugin get event-tickets --field=version
# Update to the latest available version once patched
wp plugin update event-tickets
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
