{"id":"CVE-2026-125827","kind":"vulnerability","aliases":["CVE-2026-125827"],"related":[],"title":"Event Tickets WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.31.0.","summary":"Event Tickets, a WordPress plugin by Liquid Web / StellarWP, has a missing authorization check that lets a user reach functions they should not. The description says versions through 5.31.0 are affected, and the sources give no further detail on what data or actions an attacker gets.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-tickets","package","stellarwp","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed Event Tickets plugin version in the WordPress admin under Plugins, or in the plugin header of `event-tickets/event-tickets.php`.\n- Treat any version through `5.31.0` as affected.","fix":null,"status":"open","published_at":"2026-11-13T15:17:41+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","triaged_at":"2026-11-13T15:48:59+00:00","updated_at":"2026-11-13T15:48:59+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T15:48:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Event Tickets WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"Event Tickets, a WordPress plugin by Liquid Web / StellarWP, has a missing authorization check that lets a user reach functions they should not. The description says versions through 5.31.0 are affected, and the sources give no further detail on what data or actions an attacker gets.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","event-tickets","stellarwp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to plugin functions the site restricts","analyst_note":"Check the NVD entry and the vendor or WPScan advisory for the fixed version, required privilege, and which endpoints are affected.","how_to_check":"- Check the installed Event Tickets plugin version in the WordPress admin under Plugins, or in the plugin header of `event-tickets/event-tickets.php`.\n- Treat any version through `5.31.0` as affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the Event Tickets WordPress plugin at version 5.31.0 or earlier are described as affected. The sources do not say which roles or configurations are needed to trigger it, so whether a given site is exposed is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000719,"input_tokens":4546,"output_tokens":529,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125827':13A,16A '-2026':12A,15A '5.31.0':51B,96C 'access':9A,85C 'action':65B 'affect':53B,90C 'allow':81C 'attack':67B 'author':6A,35B,70C 'check':7A,36B 'configur':84C 'control':10A,86C 'cve':11A,14A 'data':63B 'descript':47B 'detail':60B 'event':1A,18B,23B,76C,79C,91C 'event-ticket':17B,78C 'exploit':82C 'expos':8A 'function':42B 'get':68B 'give':57B 'incorrect':83C 'issu':89C 'let':38B 'levels.this':88C 'liquid':29B,73C 'miss':5A,34B,69C 'n/a':94C 'packag':20B 'plugin':4A,27B 'reach':41B 'say':48B 'secur':87C 'sourc':56B 'stellarwp':21B,31B,75C 'ticket':2A,19B,24B,77C,80C,92C 'user':40B 'version':49B 'vulner':71C 'web':30B,74C 'wordpress':3A,22B,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Event Tickets WordPress plugin at version 5.31.0 or earlier are described as affected. The sources do not say which roles or configurations are needed to trigger it, so whether a given site is exposed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventtickets","medium","package","stellarwp","wordpress"],"campaign_type":null,"search_a":"'-125827':13A,16A '-2026':12A,15A 'access':9A 'author':6A 'check':7A 'control':10A 'cve':11A,14A 'event':1A 'expos':8A 'miss':5A 'plugin':4A 'ticket':2A 'wordpress':3A","search_b":"'5.31.0':51B 'action':65B 'affect':53B 'attack':67B 'author':35B 'check':36B 'data':63B 'descript':47B 'detail':60B 'event':18B,23B 'event-ticket':17B 'function':42B 'get':68B 'give':57B 'let':38B 'liquid':29B 'miss':34B 'packag':20B 'plugin':27B 'reach':41B 'say':48B 'sourc':56B 'stellarwp':21B,31B 'ticket':19B,24B 'user':40B 'version':49B 'web':30B 'wordpress':22B,26B","search_c":"'5.31.0':96C 'access':85C 'affect':90C 'allow':81C 'author':70C 'configur':84C 'control':86C 'event':76C,79C,91C 'event-ticket':78C 'exploit':82C 'incorrect':83C 'issu':89C 'levels.this':88C 'liquid':73C 'miss':69C 'n/a':94C 'secur':87C 'stellarwp':75C 'ticket':77C,80C,92C 'vulner':71C 'web':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125827","severity":null,"published_at":"2026-11-13T15:17:41+00:00","modified_at":"2026-11-13T15:17:42+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","fetched_at":"2026-11-13T15:46:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}