CVE-2026-97634

Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter

Published Oct 2, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id they authored, as the can_access_page() gate requires only post authorship rather than the edit_others_posts capability for post owners.

Analysis

Technical impact

The Event Tickets and Registration plugin for WordPress contains a generic SQL injection flaw exposed through the 'orderby' parameter. Insufficient escaping allows authenticated users with contributor-level permissions or higher to inject arbitrary SQL statements into existing queries. This can be used to retrieve sensitive data from the database. The vulnerability is present in all releases up to and including 5.29.5.

Affected Systems

The affected product is StellarWP's Event Tickets and Registration WordPress plugin. All versions of the plugin up to version 5.29.5 are impacted.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate risk, but the vulnerability requires the attacker to be authenticated and to have authored a post or possess higher permissions. The EPSS score is not available, and the issue is not listed in CISA's KEV catalog. The likely attack vector is a contributor user supplying a crafted 'orderby' value in a request that involves an owned post. Once exploited, the attacker can read arbitrary database content, potentially exposing personal information and compromising confidentiality.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

stellarwp

Event Tickets and Registration

unaffected

Version	Status	Constraints
`0`	affected	≤ 5.29.5

No data.

Vendor Product Versions

Stellarwp

Event Tickets And Registration

Version	Status	Scheme	Platform
`[0,5.29.5]`	affected	semver	—

Wordpress-extensions

Event Tickets And Registration

Version	Status	Scheme	Platform
`[0,5.29.5]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Event Tickets and Registration plugin to a version newer than 5.29.5.
Review and sanitize any custom queries that use the 'orderby' parameter to prevent future injection.
Limit contributor-level access to trusted users or elevate the minimum required capability for accessing pages that use the vulnerable query path.

Generated by OpenCVE AI on October 2, 2026 at 08:37 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.273% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/common/src/Tribe/Repository/Query_Filters.php#L992
https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Admin_Tables/Orders.php#L157
https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Reports/Orders.php#L253
https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Repositories/Order_Repository.php#L603
https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Repositories/Order_Repository.php#L696
https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Repositories/Order_Repository.php#L822
https://plugins.trac.wordpress.org/changeset?reponame=&old=3711578%40event-tickets&new=3711578%40event-tickets
https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf2625a-3fb4-40c3-80e3-2f03fbff6bfd?source=cve

History

Oct 4, 2026 6:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 2, 2026 3:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Stellarwp Stellarwp event Tickets And Registration Wordpress-extensions Wordpress-extensions event Tickets And Registration
Vendors & Products		Stellarwp Stellarwp event Tickets And Registration Wordpress-extensions Wordpress-extensions event Tickets And Registration

Oct 2, 2026 7:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id they authored, as the can_access_page() gate requires only post authorship rather than the edit_others_posts capability for post owners.
Title		Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter
Weaknesses		CWE-89
References		https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/common/src/Tribe/Repository/Query_Filters.php#L992 https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Admin_Tables/Orders.php#L157 https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Reports/Orders.php#L253 https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Repositories/Order_Repository.php#L603 https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Repositories/Order_Repository.php#L696 https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Repositories/Order_Repository.php#L822 https://plugins.trac.wordpress.org/changeset?reponame=&old=3711578%40event-tickets&new=3711578%40event-tickets https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf2625a-3fb4-40c3-80e3-2f03fbff6bfd?source=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`