[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAO05Du9P9upchnkzFpOYaKCstB8tNETKC2vUlTxz-JE":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57705","event-tickets-and-registration-missing-authorization-3","Event Tickets and Registration \u003C= 5.28.5 - Missing Authorization","The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.28.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.","event-tickets",null,"\u003C=5.28.5","5.28.5.1","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-08 00:00:00","2026-07-14 19:37:08",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F9fd84f6c-2a24-4e0c-b388-0edc5d56a431?source=api-prod",7,[22,23,24,25,26,27,28,29],"changelog.md","common\u002Fvendor\u002Fvendor-prefixed\u002Fautoload.php","common\u002Fvendor\u002Fvendor-prefixed\u002Fcomposer\u002Fautoload_real.php","common\u002Fvendor\u002Fvendor-prefixed\u002Fcomposer\u002Fautoload_static.php","event-tickets.php","readme.txt","src\u002FTickets\u002FCommerce\u002FGateways\u002FStripe\u002FPayment_Intent.php","src\u002FTickets\u002FCommerce\u002FGateways\u002FStripe\u002FPayment_Intent_Handler.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-57705\n\n## 1. Vulnerability Summary\nThe **Event Tickets and Registration** plugin (\u003C= 5.28.5) contains a **Missing Authorization** vulnerability in its Stripe diagnostic functionality. Specifically, the function responsible for testing Stripe payment method configurations (likely `test_connection` or similar) fails to perform a capability check (e.g., `current_user_can( 'manage_options' )`). \n\nThis allows an unauthenticated attacker to trigger the `TEC\\Tickets\\Commerce\\Gateways\\Stripe\\Payment_Intent::test_creation` method. This method initiates a live API request to Stripe to create and then immediately cancel a \"Validation Test\" Payment Intent. While the intents are cancelled, an attacker can abuse this to interact with the merchant's Stripe account, potentially exhausting API rate limits or cluttering logs with unauthorized diagnostic requests.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `wp-admin\u002Fadmin-ajax.php`\n- **Action:** `tec_tickets_commerce_stripe_test_connection` (inferred based on namespace `TEC\\Tickets\\Commerce...` and common diagnostic patterns) or `tribe_tickets_commerce_stripe_test_connection`.\n- **Parameter:** `payment_methods[]` (array of Stripe payment method strings).\n- **Authentication:** None required (unauthenticated).\n- **Preconditions:** The \"Tickets Commerce\" feature must be active with the \"Stripe\" gateway selected, although the","The Event Tickets and Registration plugin for WordPress fails to validate that a client-supplied Stripe Payment Intent matches the expected order amount during the checkout process. This allows unauthenticated attackers to fulfill high-value ticket orders by providing a Payment Intent ID associated with a significantly lower-value transaction.","\u002F\u002F src\u002FTickets\u002FCommerce\u002FGateways\u002FStripe\u002FPayment_Intent_Handler.php\n\npublic function update_payment_intent( $data, \\WP_Post $order ) {\n    $body = [];\n\n    \u002F\u002F Attempt to avoid an extra request by using the existing payment intent.\n    $payment_intent = $this->get();\n\n    if ( empty( $payment_intent['id'] ) || empty( $data['payment_intent']['id'] ) || $data['payment_intent']['id'] !== $payment_intent['id'] ) {\n        $payment_intent = Payment_Intent::get( $data['payment_intent']['id'] );\n    }\n\n    \u002F\u002F Missing validation to ensure payment_intent amount matches cart\u002Forder total before proceeding\n\n    $stripe_receipt_emails = tribe_get_option( Settings::$option_stripe_receipt_emails );\n    $body['metadata']      = $this->get_updated_metadata( $order, $payment_intent );\n\n---\n\n\u002F\u002F src\u002FTickets\u002FCommerce\u002FGateways\u002FStripe\u002FREST\u002FOrder_Endpoint.php\n\n\u002F\u002F Logic within the order fulfillment endpoint\nif ( ! isset( $payment_intent['id'] ) && ! empty( $payment_intent['errors'] ) ) {\n    return new WP_Error( 'tec-tc-gateway-stripe-failed-getting-payment-intent', $messages['failed-getting-payment-intent'], $order );\n}\n\n\u002F\u002F Missing check here to confirm Payment Intent amount matches order total\n\n$status = tribe( Status::class )->convert_payment_intent_to_commerce_status( $payment_intent );","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fevent-tickets\u002F5.28.5\u002Fsrc\u002FTickets\u002FCommerce\u002FGateways\u002FStripe\u002FPayment_Intent_Handler.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fevent-tickets\u002F5.28.5.1\u002Fsrc\u002FTickets\u002FCommerce\u002FGateways\u002FStripe\u002FPayment_Intent_Handler.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fevent-tickets\u002F5.28.5\u002Fsrc\u002FTickets\u002FCommerce\u002FGateways\u002FStripe\u002FPayment_Intent_Handler.php\t2026-06-19 14:54:50.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fevent-tickets\u002F5.28.5.1\u002Fsrc\u002FTickets\u002FCommerce\u002FGateways\u002FStripe\u002FPayment_Intent_Handler.php\t2026-06-29 14:48:00.000000000 +0000\n@@ -223,6 +225,26 @@\n \t\t\t$payment_intent = Payment_Intent::get( $data['payment_intent']['id'] );\n \t\t}\n \n+\t\tif ( is_wp_error( $payment_intent ) || ! is_array( $payment_intent ) || empty( $payment_intent['id'] ) ) {\n+\t\t\treturn new WP_Error(\n+\t\t\t\t'tec-tc-gateway-stripe-payment-intent-invalid',\n+\t\t\t\t__( 'The payment could not be verified. Please refresh checkout and try again.', 'event-tickets' )\n+\t\t\t);\n+\t\t}\n+\n+\t\t\u002F*\n+\t\t * Security: the Payment Intent ID is supplied by the client, so confirm it matches the\n+\t\t * current cart before binding it to this order. Without this a Payment Intent created for\n+\t\t * a different (e.g. lower-value) cart could be attached here and later used to complete the\n+\t\t * order after paying the smaller amount.\n+\t\t *\u002F\n+\t\tif ( ! Payment_Intent::is_valid_for_cart( $payment_intent, tribe( Cart::class ) ) ) {\n+\t\t\treturn new WP_Error(\n+\t\t\t\t'tec-tc-gateway-stripe-payment-intent-cart-mismatch',\n+\t\t\t\t__( 'The selected payment does not match the items in your cart. Please refresh checkout and try again.', 'event-tickets' )\n+\t\t\t);\n+\t\t}\n+\n \t\t$stripe_receipt_emails = tribe_get_option( Settings::$option_stripe_receipt_emails );\n \t\t$body['metadata']      = $this->get_updated_metadata( $order, $payment_intent );","The exploit targets the Stripe checkout flow of the Tickets Commerce feature. \n1. An attacker identifies a high-priced ticket (e.g., $1000) and adds it to their cart.\n2. In a separate browser session or using a direct API call to Stripe, the attacker creates a Payment Intent for a minimal amount (e.g., $1) using the merchant's publishable key (or simply by starting a checkout for a $1 item elsewhere on the site).\n3. During the finalization of the $1000 ticket purchase, the attacker intercepts the client-side request to the WordPress REST API (likely the Order_Endpoint) or the AJAX handler for `update_payment_intent`.\n4. The attacker replaces the legitimate Payment Intent ID for the $1000 transaction with the Payment Intent ID for the $1 transaction.\n5. Because the plugin lacked server-side verification of the Payment Intent's 'amount' field against the actual order total, it would accept the low-value payment as valid for the high-value order and mark the tickets as fully paid upon webhook receipt or REST confirmation.","gemini-3-flash-preview","2026-07-16 15:34:05","2026-07-16 15:35:11",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","5.28.5","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fevent-tickets\u002Ftags\u002F5.28.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fevent-tickets.5.28.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fevent-tickets\u002Ftags\u002F5.28.5.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fevent-tickets.5.28.5.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fevent-tickets\u002Ftags"]