CVE-2026-105893: Event Tickets Auth Bypass Vulnerability

CVE-2026-105893 Overview

CVE-2026-105893 is an authorization bypass vulnerability in the StellarWP Event Tickets plugin for WordPress, maintained by Liquid Web. The flaw stems from an Insecure Direct Object Reference (IDOR) pattern classified under [CWE-639], where the application trusts a user-controlled key to authorize access to resources. An unauthenticated attacker can manipulate request parameters over the network to access or modify data belonging to other users or tickets. The vulnerability affects all versions of Event Tickets up to and including 5.30.0.1.

Critical Impact

Unauthenticated attackers can manipulate user-controlled identifiers to bypass authorization checks, resulting in limited integrity impact on ticketing data without requiring user interaction.

Affected Products

• StellarWP Event Tickets plugin for WordPress
• All versions from initial release through 5.30.0.1
• WordPress sites operated by event organizers using the affected plugin

Discovery Timeline

• 2026-10-08 - CVE CVE-2026-105893 published to NVD
• 2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-105893

Vulnerability Analysis

The vulnerability resides in how Event Tickets handles object references supplied in HTTP requests. The plugin accepts an identifier from the user, such as a ticket, attendee, or order ID, and acts on the referenced resource without verifying that the requester owns or is authorized to access it. This pattern is commonly described as a broken access control or Insecure Direct Object Reference issue.

Because the vulnerability is reachable over the network with no privileges and no user interaction, any remote actor can send crafted requests to a vulnerable endpoint. The impact is limited to integrity, meaning an attacker can modify specific resources but cannot directly extract confidential data or crash the service. In event ticketing contexts, abuse can affect attendee records, ticket assignments, or order metadata.

Root Cause

The root cause is a missing authorization check on a request parameter that identifies the target object. The code trusts the client-supplied key as proof of authorization rather than cross-referencing the requester's session or capability with the resource owner. [CWE-639] describes this class of flaw as Authorization Bypass Through User-Controlled Key.

Attack Vector

An attacker crafts an HTTP request to a plugin endpoint and substitutes the identifier field with the value of another user's resource. The server processes the request as if the attacker owned the resource, producing an unauthorized state change. The attack requires network access to the WordPress site but no account, credentials, or user interaction.

No verified proof-of-concept code is published. See the Patchstack advisory for Event Tickets for additional technical details.

Detection Methods for CVE-2026-105893

Indicators of Compromise

• Unexpected modifications to attendee, ticket, or order records that cannot be attributed to a legitimate authenticated session.
• HTTP requests to Event Tickets AJAX or REST endpoints containing object identifiers that do not match the requesting client's known resources.
• Spikes in anonymous or low-reputation IP traffic targeting /wp-admin/admin-ajax.php or /wp-json/tribe/ routes.

Detection Strategies

• Review WordPress and web server access logs for repeated requests to Event Tickets endpoints with sequential or enumerated ID parameters.
• Correlate database audit records of ticket and attendee tables with authenticated session activity to flag changes without a matching login.
• Deploy a web application firewall rule to log parameter tampering attempts against Event Tickets routes.

Monitoring Recommendations

• Enable verbose logging on the WordPress REST API and admin-ajax handlers used by the plugin.
• Monitor the plugin's data tables for unauthorized UPDATE or DELETE operations outside normal business hours.
• Track the plugin version installed across your fleet and alert on any instance running 5.30.0.1 or earlier.

How to Mitigate CVE-2026-105893

Immediate Actions Required

• Update Event Tickets to the version released after 5.30.0.1 that addresses this issue, as referenced in the Patchstack advisory.
• Audit recent changes to attendee, ticket, and order records for unauthorized modifications.
• Restrict administrative and ticket management endpoints to known IP ranges where feasible.

Patch Information

Liquid Web / StellarWP has addressed the broken access control issue in a release following 5.30.0.1. Refer to the Patchstack Event Tickets vulnerability record for the fixed version and advisory details. Apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

• Deploy a web application firewall rule that blocks unauthenticated requests to Event Tickets endpoints containing object ID parameters.
• Disable the Event Tickets plugin until the patched version is deployed if the site does not require active ticket sales.
• Enforce authentication on front-end ticket management flows through complementary access control plugins.

# Update Event Tickets via WP-CLI once the patched version is available
wp plugin update event-tickets
wp plugin get event-tickets --field=version