CVE-2026-105888 Overview
CVE-2026-105888 is a missing authorization vulnerability in the Liquid Web / StellarWP Event Tickets plugin for WordPress. The flaw affects all versions of event-tickets up to and including 5.30.0.1. Authenticated users with low privileges can abuse incorrectly configured access control checks to perform actions outside their intended permission scope. The vulnerability is tracked under CWE-862: Missing Authorization.
Critical Impact
Low-privileged authenticated users can access or modify plugin functionality that should be restricted to administrators, impacting confidentiality and integrity of event ticketing data.
Affected Products
- Liquid Web / StellarWP Event Tickets plugin for WordPress
- All versions up to and including 5.30.0.1
- WordPress sites running the vulnerable event-tickets plugin
Discovery Timeline
- 2026-10-08 - CVE-2026-105888 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2026-105888
Vulnerability Analysis
The vulnerability stems from missing or improperly configured authorization checks within the Event Tickets WordPress plugin. The plugin exposes functionality that fails to verify whether the requesting user holds the capability required to perform the action. An authenticated attacker with minimal privileges, such as a subscriber or contributor role, can send crafted requests to protected endpoints and perform operations reserved for higher-privileged users.
The weakness maps to CWE-862, which describes software that does not perform an authorization check when an actor attempts to access a resource or perform an action. The impact is partial disclosure and partial modification of plugin-managed data, including event tickets, attendee records, and plugin settings.
Root Cause
The root cause is an access control security level that is incorrectly configured in one or more plugin endpoints. The code paths rely on authentication alone and omit capability checks such as current_user_can() or nonce verification tied to privileged roles. Any logged-in user can therefore trigger protected routines.
Attack Vector
Exploitation requires network access to the WordPress site and valid low-privileged credentials. The attacker sends authenticated HTTP requests to the vulnerable plugin endpoints. No user interaction is required beyond the attacker's own session. Public technical details are limited; the Patchstack WordPress Vulnerability Advisory describes the broken access control condition.
No public proof-of-concept exploit code has been published. No synthetic exploitation code is provided here.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-105888
Indicators of Compromise
- Unexpected changes to event ticket configurations, attendee lists, or plugin settings by non-administrator accounts
- WordPress audit log entries showing low-privileged users invoking Event Tickets administrative actions
- Anomalous POST or AJAX requests to event-tickets plugin endpoints originating from subscriber-level sessions
Detection Strategies
- Review web server access logs for authenticated requests to Event Tickets REST API routes and admin-ajax actions issued by non-privileged users
- Monitor WordPress capability usage and flag mismatches between user role and action performed
- Correlate session identifiers with the WordPress user role performing privileged plugin operations
Monitoring Recommendations
- Enable WordPress activity logging covering plugin configuration changes, ticket creation, and attendee data access
- Alert on authenticated requests to Event Tickets endpoints from accounts that have never previously accessed them
- Ingest WordPress and web server logs into a centralized SIEM for correlation and retention
How to Mitigate CVE-2026-105888
Immediate Actions Required
- Upgrade the Event Tickets plugin to a version later than 5.30.0.1 once released by the vendor
- Audit WordPress user accounts and remove unused or untrusted low-privileged users
- Review recent plugin activity for unauthorized modifications to tickets, orders, or settings
Patch Information
At the time of publication, consult the Patchstack WordPress Vulnerability Advisory for the fixed version and vendor patch details. Apply the fixed release through the WordPress plugin updater or by replacing plugin files directly.
Workarounds
- Restrict user registration on the WordPress site to limit the pool of authenticated accounts
- Deploy a web application firewall rule that blocks unauthenticated or low-privileged access to Event Tickets administrative endpoints
- Temporarily deactivate the Event Tickets plugin on sites that cannot immediately upgrade and do not require active ticketing
# Configuration example: disable new user registration via wp-cli
wp option update users_can_register 0
# Verify installed Event Tickets plugin version
wp plugin get event-tickets --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
