The Event Tickets plugin for WordPress contains an Authorization Bypass Through User-Controlled Key vulnerability that allows an attacker to manipulate variables controlling access. This flaw bypasses the plugin’s access controls, permitting an attacker to gain unauthorized access to event data and potentially modify or delete ticket information. The weakness is classified as CWE-639, which denotes a broken access control issue.

Liquid Web / StellarWP Event Tickets plugin, versions up through 5.30.0.1 are affected. No other specific product versions are listed.

The CVSS score of 5.3 indicates a medium severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is likely to occur via crafted HTTP requests to plugin endpoints and requires the ability to submit user-controlled variables. As the flaw directly bypasses authorization checks, it could be leveraged remotely by attackers who can reach the WordPress site, making the risk moderate to high for a website that uses the plugin. The lack of an official workaround suggests that the only effective mitigation is to apply the vendor’s patch as soon as possible.