← CVE Intelligence

CVE-2026-14822

Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation PUBLISHED

Description (CNA)

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.

Affected (CNA)

Vendor / productVersions
Unknown / Event Tickets and Registrationaffected 0 before 5.29.0.1

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.