Description
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Event Tickets and Registration | < 5.29.0.1 | 5.29.0.1 |
References
- https://wpscan.com/vulnerability/ec32cf58-9fc0-4817-8492-92d80be74ef4/ exploit vdb-entry technical-description