---
id: "CVE-2026-121857"
page: "https://infrastack.ai/live/CVE-2026-121857"
kind: "vulnerability"
aliases: ["CVE-2026-121857"]
title: "WordPress Event Tickets plugin lets low-privilege users read and remove other customers' tickets"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["event-tickets", "package", "ticketing", "woocommerce", "wordpress"]
not_affected_if: ["admin-only-access", "fixed-version"]
published_at: "2026-11-07T06:16:58+00:00"
first_seen_at: "2026-11-07T06:46:04+00:00"
updated_at: "2026-11-07T06:48:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121857", "first_seen_at": "2026-11-07T06:46:04+00:00"}]
exploit_sources: []
---

# WordPress Event Tickets plugin lets low-privilege users read and remove other customers' tickets

Link for people: https://infrastack.ai/live/CVE-2026-121857 (this .md is for agents)

The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 skips the check that a user may manage WooCommerce orders before returning or removing ticket data. Any role granted access to its admin area, down to Subscriber, can view other customers' ticket codes and names and remove tickets from their orders.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Event Tickets with Ticket Scanner plugin.
- Review which roles have been granted access to the plugin's admin area, especially Subscriber or other low-privilege roles.

## Fix

- Event Tickets with Ticket Scanner: move to `3.1.14` or later (the first version the description does not list as affected).

## Timeline

- 2026-11-07T06:46:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121857

## From the sources

The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_