CVE-2026-3174: WordPress Event Tickets Auth Bypass Flaw

CVE-2026-3174 Overview

CVE-2026-3174 is a missing authorization vulnerability [CWE-862] in the Event Tickets and Registration plugin for WordPress. The flaw affects all plugin versions up to and including 5.27.4. The Stripe OAuth return endpoint lacks a capability check, allowing unauthenticated attackers to overwrite Stripe merchant credentials stored by the site. An attacker can replace the site's Stripe access token, publishable key, and account ID with attacker-controlled values. All subsequent payment processing then routes to the attacker's Stripe account.

Critical Impact
Unauthenticated attackers can hijack payment processing by overwriting Stripe merchant credentials, redirecting customer payments to attacker-controlled Stripe accounts.

Affected Products

Event Tickets and Registration plugin for WordPress
All versions up to and including 5.27.4
WordPress sites using Stripe as the Tickets Commerce gateway

Discovery Timeline

2026-09-08 - CVE-2026-3174 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-3174

Vulnerability Analysis

The vulnerability resides in the Stripe integration of the Tickets Commerce module. Specifically, the REST route defined in Return_Endpoint.php handles the OAuth callback after a merchant connects their Stripe account. The endpoint processes returned credentials and persists them through the Merchant.php signup handler.

The endpoint does not verify that the caller is an administrator or that the request originates from a legitimate Stripe OAuth flow. Any unauthenticated actor can craft a direct request to the REST endpoint and supply arbitrary Stripe credentials. The plugin accepts these values and writes them into the site's stored merchant configuration.

Once written, the site treats the attacker-controlled access_token, publishable_key, and stripe_user_id as legitimate. Every subsequent ticket purchase is processed through the attacker's Stripe account. This results in complete diversion of revenue without alerting the site owner.

Root Cause

The root cause is a missing capability check on the REST API return endpoint that handles Stripe OAuth completion. The route relies on the presence of request parameters rather than verifying the requester's WordPress capabilities or validating a signed state parameter tied to the initiating administrator session.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends a crafted HTTP request to the vulnerable REST endpoint with attacker-controlled Stripe credentials embedded in the parameters. No authentication, user interaction, or existing session is required. The vulnerability affects integrity of stored payment configuration without impacting confidentiality or availability of the site itself.

See the WordPress Stripe Return Endpoint Code and the WordPress Stripe Merchant Code for the affected code paths.

Detection Methods for CVE-2026-3174

Indicators of Compromise

Unexpected changes to Stripe merchant settings in the Tickets Commerce configuration, including unfamiliar stripe_user_id values or publishable keys not matching the merchant's Stripe dashboard.
Web server access logs showing unauthenticated requests to the plugin's Stripe REST return endpoint from unknown IP addresses.
Ticket revenue reported in the Stripe dashboard diverging from ticket sales recorded in WordPress.

Detection Strategies

Audit the WordPress options table for Tickets Commerce Stripe entries and compare stored account identifiers against the legitimate Stripe account.
Monitor HTTP traffic to /wp-json/tribe/tickets/v1/commerce/stripe/return and similar plugin routes for requests without a valid administrator session cookie.
Alert on changes to WordPress options containing Stripe credential keys through file integrity or database change monitoring.

Monitoring Recommendations

Enable WordPress audit logging for options and settings changes tied to payment gateways.
Reconcile Stripe payout account details against the configured WordPress merchant account on a recurring schedule.
Forward WordPress and web server logs to a centralized log platform and alert on anomalous REST API activity targeting plugin endpoints.

How to Mitigate CVE-2026-3174

Immediate Actions Required

Update the Event Tickets and Registration plugin to a version later than 5.27.4 that includes the fix from WordPress Changeset Update #3472837.
Verify current Stripe merchant credentials in the plugin match the legitimate Stripe account. Reconnect the Stripe integration if any discrepancy exists.
Rotate Stripe API keys and review recent payouts and transactions for unauthorized activity.

Patch Information

The vendor addressed the vulnerability in changeset 3472837, which adds the missing authorization check to the Stripe OAuth return endpoint. Site administrators should upgrade to the patched release published on the WordPress plugin repository. Refer to the Wordfence Vulnerability Insight for advisory details.

Workarounds

Restrict access to the plugin's Stripe REST endpoints at the web server or web application firewall layer until the patch is applied.
Temporarily disable the Stripe gateway in Tickets Commerce settings if patching cannot be performed immediately.
Require authenticated administrator sessions for all /wp-json/tribe/tickets/* routes through WAF policy or plugin-level access controls.

bash

# Example WAF rule to block unauthenticated access to the vulnerable endpoint
# Adjust to your WAF syntax and site path
SecRule REQUEST_URI "@rx /wp-json/tribe/tickets/v1/commerce/stripe/return" \
    "id:1002026,phase:1,deny,status:403,log,\
    msg:'Block unauthenticated Stripe OAuth return endpoint (CVE-2026-3174)',\
    chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"