Description
The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id they authored, as the can_access_page() gate requires only post authorship rather than the edit_others_posts capability for post owners.
Published: 2026-10-02
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized database query leading to data exposure
Action: Update Plugin
AI Analysis

Impact

The Event Tickets and Registration plugin for WordPress contains a generic SQL injection flaw exposed through the 'orderby' parameter. Insufficient escaping allows authenticated users with contributor-level permissions or higher to inject arbitrary SQL statements into existing queries. This can be used to retrieve sensitive data from the database. The vulnerability is present in all releases up to and including 5.29.5.

Affected Systems

The affected product is StellarWP's Event Tickets and Registration WordPress plugin. All versions of the plugin up to version 5.29.5 are impacted.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate risk, but the vulnerability requires the attacker to be authenticated and to have authored a post or possess higher permissions. The EPSS score is not available, and the issue is not listed in CISA's KEV catalog. The likely attack vector is a contributor user supplying a crafted 'orderby' value in a request that involves an owned post. Once exploited, the attacker can read arbitrary database content, potentially exposing personal information and compromising confidentiality.

Generated by OpenCVE AI on October 2, 2026 at 08:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Event Tickets and Registration plugin to a version newer than 5.29.5.
  • Review and sanitize any custom queries that use the 'orderby' parameter to prevent future injection.
  • Limit contributor-level access to trusted users or elevate the minimum required capability for accessing pages that use the vulnerable query path.

Generated by OpenCVE AI on October 2, 2026 at 08:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 04 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Stellarwp
Stellarwp event Tickets And Registration
Wordpress-extensions
Wordpress-extensions event Tickets And Registration
Vendors & Products Stellarwp
Stellarwp event Tickets And Registration
Wordpress-extensions
Wordpress-extensions event Tickets And Registration

Fri, 02 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Description The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id they authored, as the can_access_page() gate requires only post authorship rather than the edit_others_posts capability for post owners.
Title Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Stellarwp Event Tickets And Registration
Wordpress-extensions Event Tickets And Registration
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-02T18:04:16.720Z

Reserved: 2026-09-24T17:13:39.561Z

Link: CVE-2026-97634

cve-icon Vulnrichment

Updated: 2026-10-02T18:04:13.037Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T08:17:05.487

Modified: 2026-10-02T18:17:10.227

Link: CVE-2026-97634

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T14:45:49Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')