{"id":"CVE-2026-62055","kind":"vulnerability","aliases":["CVE-2026-62055"],"related":[],"title":"Event Tickets WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.","summary":"Event Tickets, a WordPress plugin from Liquid Web and StellarWP, has a missing authorization check in versions up to and including 5.30.2. The sources say an attacker can exploit incorrectly configured access control levels to reach functions they should not.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-tickets","package","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed Event Tickets plugin version in the WordPress admin plugins list; versions up to `5.30.2` are listed as affected.","fix":"- Event Tickets versions after `5.30.2` (fixed version not stated in the sources)","status":"open","published_at":"2026-10-30T17:17:27+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:19+00:00","updated_at":"2026-10-30T17:32:19+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T17:32:19Z","model":"claude-haiku-5-5","output":{"fix":"- Event Tickets versions after `5.30.2` (fixed version not stated in the sources)\n- unknown","reach":"internet","title":"Event Tickets WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"Event Tickets, a WordPress plugin from Liquid Web and StellarWP, has a missing authorization check in versions up to and including 5.30.2. The sources say an attacker can exploit incorrectly configured access control levels to reach functions they should not.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","event-tickets"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach restricted plugin functions on the site","analyst_note":"Find the NVD or vendor page for the fixed version and the affected endpoint and required role; sources here give only the CVSS score and a generic description.","how_to_check":"- Check the installed Event Tickets plugin version in the WordPress admin plugins list; versions up to `5.30.2` are listed as affected.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the Event Tickets WordPress plugin at version 5.30.2 or earlier. The sources do not say which configurations or roles are needed to exploit it, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000672,"input_tokens":4118,"output_tokens":520,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62055':13A,16A '5.30.2':43B,86C 'access':9A,53B,75C 'affect':80C 'allow':71C 'attack':48B 'author':6A,35B,60C 'check':7A,36B 'configur':52B,74C 'control':10A,54B,76C 'cve':11A,14A 'event':1A,18B,22B,66C,69C,81C 'event-ticket':17B,68C 'exploit':50B,72C 'expos':8A 'function':58B 'includ':42B 'incorrect':51B,73C 'issu':79C 'level':55B 'levels.this':78C 'liquid':28B,63C 'miss':5A,34B,59C 'n/a':84C 'packag':20B 'plugin':4A,26B 'reach':57B 'say':46B 'secur':77C 'sourc':45B 'stellarwp':31B,65C 'ticket':2A,19B,23B,67C,70C,82C 'version':38B 'vulner':61C 'web':29B,64C 'wordpress':3A,21B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Event Tickets WordPress plugin at version 5.30.2 or earlier. The sources do not say which configurations or roles are needed to exploit it, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62055","severity":null,"published_at":"2026-10-30T17:17:27+00:00","modified_at":"2026-10-30T17:18:40+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}