The Event Tickets and Registration WordPress plugin fails to enforce authorization on a specific order‑management REST endpoint, enabling any unauthenticated user to alter the status of an existing order. This flaw permits an attacker to modify the integrity of order data, potentially changing an order from pending to completed or deleted without permission.

WordPress sites that have the Event Tickets and Registration plugin installed and running a version earlier than 5.29.0.1 are affected. Sites using any older release of the plugin with the default configuration are vulnerable to unauthenticated manipulation of order statuses.

The exploitation likelihood is low, as indicated by an EPSS score of less than 1%, and the CVSS score of 5.3 indicates moderate severity. The vulnerability does not appear in the CISA KEV catalog, suggesting no publicly documented exploits. However, the REST endpoint is reachable without authentication, making the attack vector simple: an attacker can send crafted HTTP requests directly to the endpoint to change order states. While the EPSS score suggests a lower probability of attack, sites remain at risk of unauthorized data modification if the plugin is not updated.