CVE-2026-34898: Unauthenticated Access Control Bypass in Event Tickets Manager for WooCommerce ≤1.5.3

Technical summary

The vulnerability stems from missing or improperly implemented authorization checks in Event Tickets Manager for WooCommerce. The plugin fails to enforce authentication and authorization on sensitive endpoints or functions responsible for ticket management. This Missing Access Control (CWE-862) condition permits unauthenticated HTTP requests to perform state-changing operations—such as creating, modifying, or deleting tickets—that should be restricted to authenticated administrators or authorized users. The flaw is network-accessible and requires no user interaction to exploit.

Business impact

Event organizers and WooCommerce store operators using this plugin face direct integrity risk to their ticketing operations. Attackers can fraudulently modify ticket inventories, allocate tickets without payment, revoke legitimate tickets, or corrupt ticket data, leading to revenue loss, customer dissatisfaction, and operational chaos during events. Remediation requires immediate patching; delayed updates risk event cancellation, refund disputes, and reputational damage.

Affected systems

WordPress sites with WooCommerce and the Event Tickets Manager for WooCommerce plugin installed at version 1.5.3 or earlier. The plugin is available in the WordPress plugin repository, making it widely deployed. Any publicly accessible WooCommerce instance running this plugin version is exposed without additional network controls.

Exploitability

This vulnerability has a high exploitability profile. The attack vector is network-based, requires no authentication or privileges, and does not depend on user interaction. An attacker can craft direct HTTP requests to exploit the broken access control from any internet-connected machine. The low complexity and lack of prerequisites make this a trivial attack to execute; automated scanning and exploitation are feasible. No KEV listing or known exploitation data is currently available, but the ease of exploitation means threat actors will likely prioritize this once awareness spreads.

Remediation

Administrators must immediately update Event Tickets Manager for WooCommerce to a patched version above 1.5.3. Verify the new version number in the vendor's advisory or plugin repository before deploying. If a patch is not yet available, restrict plugin functionality via Web Application Firewall (WAF) rules to block unauthenticated access to ticket management endpoints, or temporarily disable the plugin until a fix is released. Audit logs to identify if tickets have been tampered with since deployment.

Patch guidance

Update Event Tickets Manager for WooCommerce to the latest available version from the WordPress plugin repository or vendor site. Always verify the version number post-update. Test the update in a staging environment first to ensure compatibility with your WooCommerce configuration and other plugins. If the vendor has not released a patch, contact them directly and request an estimated timeline. As an interim measure, apply WAF rules to deny unauthenticated requests to paths or parameters associated with ticket creation and modification.

Detection guidance

Monitor for HTTP requests to ticket management endpoints without valid authentication tokens or session cookies—look for POST/PUT/DELETE requests to endpoints like `/wp-json/etm/...` or similar patterns originating from external IP addresses. Alert on any modifications to the wp_postmeta table where ticket data is stored without corresponding authenticated user activity. Query logs for 403 responses followed by successful state-changing requests (a sign of access control bypass). Implement network segmentation to ensure only authorized systems can reach WooCommerce admin functions.

Why prioritize this

This vulnerability scores 7.5 (HIGH) due to its network attack vector, low complexity, and integrity impact on business-critical ticketing data. The absence of authentication requirements combined with the ability to modify ticket state makes this a serious risk for event-driven commerce. Organizations operating events should treat this with urgency. While not yet actively exploited in the wild (no KEV entry), the trivial exploitation path means it will likely be targeted soon.

Risk score, explained

CVSS 3.1 score of 7.5 reflects AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), S:U (unchanged scope), C:N (no confidentiality impact), I:H (high integrity impact), and A:N (no availability impact). The score emphasizes that unauthenticated attackers can directly corrupt ticket data from the internet without user assistance. Confidentiality is unaffected because the flaw enables writes, not unauthorized reads; availability is typically not impacted unless the attacker deliberately deletes all tickets.

Frequently asked questions