The vulnerability arises because the Event Tickets Manager for WooCommerce plugin does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured. The plugin stores the submitted price globally and applies it to the next event ticket added to any cart. This allows unauthenticated visitors to buy tickets at arbitrary prices, including for free, thereby compromising the integrity of the payment system and potentially causing financial loss.

The affected product is the Event Tickets Manager for WooCommerce WordPress plugin, with vulnerable releases from version 1.5.4 through 1.5.9. The plugin is distributed by Unknown:Event Tickets Manager for WooCommerce. No other vendors or product versions are listed.

The CVSS score is not provided, and EPSS data is unavailable, so the quantitative severity cannot be stated. The vulnerability is exploitable through an unauthenticated AJAX request to the plugin’s endpoint, meaning that any visitor with network access to the site could manipulate ticket prices. Because the issue is a direct input validation flaw that changes site‑wide pricing, the impact is potentially high if an attacker repeatedly uses the vulnerability to offer free tickets or significantly lower prices. The vulnerability is not currently listed in the CISA KEV catalog, indicating no publicly known exploitation yet, but the lack of authentication requirement makes it accessible to any attacker.