CVE-2026-14822

The Event Tickets and Registration plugin for WordPress prior to version 5.29.0.1 is vulnerable due to a lack of authorization checks on its order-management REST endpoint, enabling unauthenticated users to modify the status of existing orders. This could lead to unauthorized changes in order management, potentially impacting the integrity of event registrations and ticketing processes. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.