High · published October 18, 2025
⚡ Unauthenticated users can snag paid tickets for free! The Event Tickets and Registration plugin for WordPress has a sneaky endpoint that lets them bypass payment entirely. 🔥 Think of it like a concert where the ticketing system doesn't check if someone actually paid at the door — anyone could just waltz in and enjoy the show without spending a dime! This could lead to a significant revenue loss for organizers, as attackers exploit the flaw to grab access to paid events while leaving event hosts empty-handed. Worse, it could encourage malicious actors to target multiple events, amplifying the financial impact.
Think of it like a concert where the ticketing system doesn't check if someone actually paid at the door — anyone could just waltz in and enjoy the show without spending a dime! The vulnerability lies in the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not properly verifying whether a ticket should be free, allowing unauthorized access to paid ticket types directly.
This could lead to a significant revenue loss for organizers, as attackers exploit the flaw to grab access to paid events while leaving event hosts empty-handed. Worse, it could encourage malicious actors to target multiple events, amplifying the financial impact. Update the Event Tickets and Registration plugin to version 5.26.6 or later to close this loophole. Additionally, review your ticket settings and permissions to ensure proper validation is enforced for all ticket types. 🛡️ You've got this! Follow these steps to secure your ticketing system and keep those profits intact! 🎉