CVE-2026-123129
Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Ticket Price Manipulation
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next event ticket added to any cart, allowing unauthenticated visitors to buy event tickets at an arbitrary price, including for free. This is due to an incomplete fix of CVE-2026-34898.
| Vendor | unknown |
| Product | event tickets manager for woocommerce |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown event tickets manager for woocommerce
Be the first to know when new medium vulnerabilities affecting unknown event tickets manager for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Event Tickets Manager for WooCommerce
1.5.4 < 1.6.0
References
Credits
Sunil Tripathy WPScan