CVE-2026-34898: WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.3 - Broken Access Control vulnerability

Synopsis

This is a broken access control vulnerability in the Event Tickets Manager for WooCommerce WordPress plugin, affecting all versions up to and including 1.5.3. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable by any remote attacker. Successful exploitation allows an attacker to make unauthorized modifications to data managed by the plugin, such as ticket records, event configurations, or order-related information. HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session credential of any kind is needed to trigger the access control bypass.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  Exploit reliability is high with no race conditions or special environmental factors required; a straightforward request is sufficient.

Blast Radius

• An attacker can make unauthorized writes to plugin-managed data, including ticket records, event settings, and associated WooCommerce order metadata.
• Access controls protecting privileged plugin actions are bypassed, allowing an unauthenticated party to perform operations normally restricted to administrators or store managers.
• Integrity of ticket inventory and event configuration is compromised, which can directly affect event sales, attendee records, and downstream order processing.