{"id":"CVE-2026-121857","kind":"vulnerability","aliases":["CVE-2026-121857"],"related":[],"title":"WordPress Event Tickets plugin lets low-privilege users read and remove other customers' tickets","description":"The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders.","summary":"The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 skips the check that a user may manage WooCommerce orders before returning or removing ticket data. Any role granted access to its admin area, down to Subscriber, can view other customers' ticket codes and names and remove tickets from their orders.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-tickets","package","ticketing","woocommerce","wordpress"],"not_affected_if":["admin-only-access","fixed-version"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Event Tickets with Ticket Scanner plugin.\n- Review which roles have been granted access to the plugin's admin area, especially Subscriber or other low-privilege roles.","fix":"- Event Tickets with Ticket Scanner: move to `3.1.14` or later (the first version the description does not list as affected).","status":"open","published_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:18+00:00","updated_at":"2026-11-07T06:48:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T06:48:18Z","model":"claude-haiku-5-5","output":{"fix":"- Event Tickets with Ticket Scanner: move to `3.1.14` or later (the first version the description does not list as affected).","reach":"internet","title":"WordPress Event Tickets plugin lets low-privilege users read and remove other customers' tickets","impact":"medium","summary":"The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 skips the check that a user may manage WooCommerce orders before returning or removing ticket data. Any role granted access to its admin area, down to Subscriber, can view other customers' ticket codes and names and remove tickets from their orders.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","event-tickets","ticketing"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Customer ticket codes and names readable; tickets removed from orders by low-privilege accounts","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Event Tickets with Ticket Scanner plugin.\n- Review which roles have been granted access to the plugin's admin area, especially Subscriber or other low-privilege roles.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","admin-only-access"],"who_is_affected":"Sites running the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 that have granted any role access to the plugin's admin area. Sites that only let administrators use the plugin, or that run a fixed version, are not exposed in the same way.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00073,"input_tokens":4265,"output_tokens":607,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121857':18A,21A '-2026':17A,20A '3.1.14':38B,89C,127C 'access':58B,116C 'admin':61B,129C 'administr':113C 'allow':109C 'area':62B,130C 'check':41B,92C 'code':71B,139C 'custom':14A,69B,137C 'cve':16A,19A 'data':54B,105C 'event':2A,23B,30B,81C,119C 'event-ticket':22B 'grant':57B,115C 'let':5A 'low':7A 'low-privileg':6A 'manag':46B,97C 'may':45B,96C 'name':73B,141C 'order':48B,79B,99C,108C,148C 'packag':25B 'plugin':4A,36B,87C,125C 'privileg':8A 'read':10A 'remov':12A,52B,75B,103C,144C 'return':50B,101C 'role':56B,111C 'scanner':34B,85C,123C 'skip':39B 'subscrib':65B,133C 'ticket':3A,15A,24B,26B,31B,33B,53B,70B,76B,82C,84C,104C,120C,122C,138C,145C 'user':9A,44B,95C 'view':67B,135C 'woocommerc':27B,47B,98C 'wordpress':1A,28B,35B,86C,124C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 that have granted any role access to the plugin's admin area. Sites that only let administrators use the plugin, or that run a fixed version, are not exposed in the same way.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventtickets","medium","package","ticketing","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-121857':18A,21A '-2026':17A,20A 'custom':14A 'cve':16A,19A 'event':2A 'let':5A 'low':7A 'low-privileg':6A 'plugin':4A 'privileg':8A 'read':10A 'remov':12A 'ticket':3A,15A 'user':9A 'wordpress':1A","search_b":"'3.1.14':38B 'access':58B 'admin':61B 'area':62B 'check':41B 'code':71B 'custom':69B 'data':54B 'event':23B,30B 'event-ticket':22B 'grant':57B 'manag':46B 'may':45B 'name':73B 'order':48B,79B 'packag':25B 'plugin':36B 'remov':52B,75B 'return':50B 'role':56B 'scanner':34B 'skip':39B 'subscrib':65B 'ticket':24B,26B,31B,33B,53B,70B,76B 'user':44B 'view':67B 'woocommerc':27B,47B 'wordpress':28B,35B","search_c":"'3.1.14':89C,127C 'access':116C 'admin':129C 'administr':113C 'allow':109C 'area':130C 'check':92C 'code':139C 'custom':137C 'data':105C 'event':81C,119C 'grant':115C 'manag':97C 'may':96C 'name':141C 'order':99C,108C,148C 'plugin':87C,125C 'remov':103C,144C 'return':101C 'role':111C 'scanner':85C,123C 'subscrib':133C 'ticket':82C,84C,104C,120C,122C,138C,145C 'user':95C 'view':135C 'woocommerc':98C 'wordpress':86C,124C","first_public_at":"2026-11-07T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121857","severity":null,"published_at":"2026-11-07T06:16:58+00:00","modified_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}