CVE-2026-121857 · Package
NO FIX YET · SEE WHAT TO DO
The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 skips the check that a user may manage WooCommerce orders before returning or removing ticket data. Any role granted access to its admin area, down to Subscriber, can view other customers' ticket codes and names and remove tickets from their orders.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 that have granted any role access to the plugin's admin area. Sites that only let administrators use the plugin, or that run a fixed version, are not exposed in the same way.
Not affected if admin-only-access, fixed-version
Who cares event-tickets, ticketing, woocommerce, wordpress
wp-content/plugins/ for the Event Tickets with Ticket Scanner plugin.3.1.14 or later (the first version the description does not list as affected).The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.