[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fl_QBGuNYjzNwLlUuMhxAdntO2hRnuNiBuYNBU1haNqE":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-57400","event-tickets-manager-for-woocommerce-missing-authorization-2","Event Tickets Manager for WooCommerce \u003C= 1.5.5 - Missing Authorization","The Event Tickets Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.","event-tickets-manager-for-woocommerce",null,"\u003C=1.5.5","1.5.6","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-08 00:00:00","2026-07-14 19:43:58",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F4ec0fc39-1e26-44f1-827e-aabeb0347d0a?source=api-prod",7,[22,23,24,25,26,27,28,29],"Demo\u002Fwps-etmfw-mail-html-content.php","README.txt","admin\u002Fclass-event-tickets-manager-for-woocommerce-admin.php","admin\u002Fcss\u002Fevent-tickets-manager-for-woocommerce-admin-ui.css","admin\u002Fpartials\u002Fevent-tickets-manager-for-woocommerce-ticket-layout-setting.php","admin\u002Fsrc\u002Fscss\u002Fevent-tickets-manager-for-woocommerce-admin-global.css","emails\u002Ftemplates\u002Fwps-etmfw-mail-html-content.php","event-tickets-manager-for-woocommerce.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-57400\n\n## 1. Vulnerability Summary\nThe **Event Tickets Manager for WooCommerce** plugin (versions \u003C= 1.5.5) is vulnerable to **Missing Authorization** and **Cross-Site Request Forgery (CSRF)**. The vulnerability exists in the ticket layout settings processing logic. Specifically, the code responsible for saving \"Design\" settings fails to verify user capabilities or check for a security nonce. This allows unauthenticated attackers to modify critical plugin configuration options by sending a crafted POST request.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-post.php` (or any endpoint that triggers `admin_init`).\n*   **Target File:** `admin\u002Fpartials\u002Fevent-tickets-manager-for-woocommerce-ticket-layout-setting.php`\n*   **Vulnerable Parameter:** `wps_etmfw_new_layout_setting_save_2`\n*   **Authentication:** Unauthenticated (`PR:N` per CVSS).\n*   **Preconditions:** The plugin must be active. The vulnerability assumes the plugin includes the partial file during an early admin hook (like `admin_init`) without restricting it to the settings page or checking permissions.\n\n## 3. Code Flow\n1.  An attacker sends an unauthenticated POST request to `admin-post.php`.\n2.  WordPress initializes and triggers the `admin_init` hook.\n3.  The plugin (likely in its main admin class) includes `admin\u002Fpartials\u002Fevent-tickets-manager-for-woocommerce-ticket-layout-setting.php` to handle or display settings.\n4.  The code in the partial executes top-down:\n    *   It checks `isset( $_POST['wps_etmfw_new_layout_setting_save'] )` (Line 19) — this block is protected by a nonce.\n    *   It then checks `isset( $_POST['wps_etmfw_new_layout_setting_save_2'] )` (Line 70).\n5.  If `wps_etmfw_new_layout_setting_save_2` is present, the plugin proceeds to extract values from `$_POST` and calls `update_option()` (Lines 74-84) for various settings without any further checks.\n\n## 4. Nonce Acquisition Strategy\nAccording to the source code analysis of `admin\u002Fpartials\u002Fevent-tickets-manager-for-woocommerce-ticket-layout-setting.php`:\n*   The first block (saving templates) uses a nonce: `wp_verify_nonce( $wps_verify_nonce_form, 'wps_layout_nonce_verify' )`.\n*   The second block (saving design settings) starting at **Line 70** has **no nonce check** and **no capability check**.\n\n**Strategy:** No nonce is required to exploit the `wps_etmfw_new_layout_setting_save_2` code path. The exploit can be performed directly via an unauthenticated POST request.\n\n## 5. Exploitation Strategy\nThe goal is to modify the plugin's PDF background color and text color options to prove unauthorized settings modification.\n\n### HTTP Request (via `http_request` tool)\n*   **Method:** POST\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-post.php`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:**\n    ```\n    action=null&wps_etmfw_new_layout_setting_save_2=1&wps_etmfw_pdf_background_color=%23ff0000&wps_etmfw_pdf_text_color=%2300ff00&wps_etmfw_logo_size=999\n    ```\n    *(Note: The `action` parameter is included to satisfy admin-post.php, even if the plugin doesn't explicitly handle that specific action string, as long as it triggers the inclusion of the partial file during admin_init.)*\n\n## 6. Test Data Setup\n1.  Install and activate **WooCommerce**.\n2.  Install and activate **Event Tickets Manager for WooCommerce** v1.5.5.\n3.  No specific tickets or events are needed, as this targets global plugin options.\n\n## 7. Expected Results\n*   The server should return a `200 OK` or `302 Redirect` (depending on how the plugin finishes the include).\n*   The WordPress database options `wps_etmfw_pdf_background_color` will be updated to `#ff0000`.\n*   The option `wps_etmfw_pdf_text_color` will be updated to `#00ff00`.\n*   The option `wps_etmfw_logo_size` will be updated to `999`.\n\n## 8. Verification Steps\nAfter performing the HTTP request, verify the changes using WP-CLI:\n```bash\nwp option get wps_etmfw_pdf_background_color\nwp option get wps_etmfw_pdf_text_color\nwp option get wps_etmfw_logo_size\n```\nIf the values match the payload (`#ff0000`, `#00ff00`, `999`), the unauthorized modification is confirmed.\n\n## 9. Alternative Approaches\nIf `\u002Fwp-admin\u002Fadmin-post.php` does not trigger the code, attempt the same payload against:\n1.  `\u002Fwp-admin\u002Fadmin-ajax.php?action=any_string`\n2.  `\u002Fwp-admin\u002Findex.php` (if the plugin loads the partial globally in the admin dashboard).\n\nIf the \"unauthenticated\" claim in the CVE description relies on a specific state (e.g., a specific plugin tab being active in the session), try accessing the endpoint as a low-privileged user (Subscriber) to verify that `manage_options` capability is not enforced. However, based on the missing check in the source, a direct unauthenticated POST remains the primary vector.","gemini-3-flash-preview","2026-07-16 15:28:50","2026-07-16 15:30:23",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","1.5.5","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fevent-tickets-manager-for-woocommerce\u002Ftags\u002F1.5.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fevent-tickets-manager-for-woocommerce.1.5.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fevent-tickets-manager-for-woocommerce\u002Ftags\u002F1.5.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fevent-tickets-manager-for-woocommerce.1.5.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fevent-tickets-manager-for-woocommerce\u002Ftags"]