EVENT TICKETS MANAGER FOR WOOCOMMERCE · CVE-2026-123129 · Package
NO FIX YET · SEE WHAT TO DO
The Event Tickets Manager for WooCommerce plugin before 1.6.0 accepts a ticket price through an unauthenticated AJAX action without validating it, and stores it site-wide. The next event ticket added to any cart then uses that price, so anyone can buy tickets for any amount, including free.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Event Tickets Manager for WooCommerce plugin before 1.6.0 that sell event tickets through WooCommerce. The flaw is in an unauthenticated AJAX action, so no login is needed, and the sources say it applies when the referenced product has no ticket types configured. The sources note this is an incomplete fix of CVE-2026-34898, so a site that only applied the earlier fix is still exposed.
Not affected if no-event-ticket-sales, plugin-version-1.6.0-or-later
Who cares event-tickets, self-hosted, woocommerce, wordpress
1.6.01.6.0 or later, according to the sourcesThe Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next event ticket added to any cart, allowing unauthenticated visitors to buy event tickets at an arbitrary price, including for free.
This is due to an incomplete fix of CVE-2026-34898.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.