CVE-2026-105891 Overview
CVE-2026-105891 is a Missing Authorization vulnerability [CWE-862] in the StellarWP Event Tickets plugin for WordPress, maintained by Liquid Web. The flaw affects Event Tickets versions up to and including 5.30.0.1. Incorrectly configured access control security levels allow an authenticated user with low privileges to interact with functionality that should be restricted. The weakness enables limited unauthorized modification of plugin data over the network without user interaction.
Critical Impact
Authenticated attackers with low privileges can bypass access control checks in the Event Tickets plugin, causing integrity impact on ticketing data served through WordPress sites.
Affected Products
- StellarWP Event Tickets plugin for WordPress
- Event Tickets versions from n/a through 5.30.0.1
- WordPress sites running the vulnerable event-tickets plugin
Discovery Timeline
- 2026-10-08 - CVE-2026-105891 published to NVD
- 2026-10-10 - Last updated in NVD database
Technical Details for CVE-2026-105891
Vulnerability Analysis
The vulnerability resides in the event-tickets plugin's handling of authorization for specific actions. The plugin exposes functionality that fails to verify whether the requesting user holds the required capability for the operation. An authenticated attacker with low privileges, such as a subscriber-level WordPress account, can invoke the affected endpoints and modify data that should be restricted to higher-privilege roles.
The network attack vector requires no user interaction. The impact is limited to integrity, with no confidentiality or availability consequences reported. Patchstack tracks this as a broken access control issue in the plugin's request handling path. Full technical details are available in the Patchstack Vulnerability Report.
Root Cause
The root cause is a missing or improperly configured authorization check [CWE-862]. The plugin's code path invokes a sensitive action without validating the caller's WordPress capability or role. Authentication alone is treated as sufficient, which violates the principle of least privilege.
Attack Vector
An attacker first obtains any authenticated session on the target WordPress site, including a self-registered subscriber account where open registration is enabled. The attacker then issues an HTTP request to the vulnerable plugin endpoint. Because the server-side handler omits a proper capability check, the request succeeds and modifies plugin-managed data.
No verified public proof-of-concept code is available at this time. Refer to the Patchstack advisory for request-level details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-105891
Indicators of Compromise
- Unexpected modifications to Event Tickets records, attendee lists, or ticket metadata that were not initiated by site administrators.
- WordPress audit log entries showing low-privilege accounts invoking Event Tickets AJAX actions or REST endpoints.
- New or modified attendee records attributed to subscriber-level user IDs.
Detection Strategies
- Review WordPress access logs for requests to admin-ajax.php and /wp-json/ routes that reference event-tickets actions from non-administrative accounts.
- Correlate HTTP 200 responses on plugin endpoints with the role of the requesting user to identify authorization gaps.
- Enable a WordPress audit logging plugin to record capability-sensitive actions performed by low-privilege users.
Monitoring Recommendations
- Monitor the installed version of Event Tickets across all managed WordPress instances and alert on versions at or below 5.30.0.1.
- Track user registration spikes followed by requests to Event Tickets endpoints, which may indicate reconnaissance or exploitation.
- Forward WordPress and web server logs to a centralized log platform for retention and anomaly detection.
How to Mitigate CVE-2026-105891
Immediate Actions Required
- Update the StellarWP Event Tickets plugin to a version later than 5.30.0.1 as soon as a fixed release is published.
- Audit WordPress user roles and remove unnecessary subscriber or contributor accounts.
- Disable open user registration on sites that do not require it by unchecking Anyone can register in Settings > General.
Patch Information
At the time of publication, the Patchstack advisory lists all versions up to and including 5.30.0.1 as affected. Site operators should monitor the Patchstack Vulnerability Report and the plugin's changelog in the WordPress plugin repository for a patched release.
Workarounds
- Deploy a Web Application Firewall (WAF) rule that blocks requests to vulnerable Event Tickets endpoints from users without edit_posts or higher capabilities.
- Temporarily deactivate the Event Tickets plugin on sites where ticketing functionality is not actively required.
- Restrict access to /wp-admin/admin-ajax.php and REST API routes by IP where feasible until a fix is applied.
# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0
# List installed plugin version to confirm exposure
wp plugin get event-tickets --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
