CVE-2026-121857mediumCWE-863

CVE-2026-121857: medium-severity vulnerability in Event Tickets with Ticket Scanner

Event Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend

Published

Follow this CVE+ Monitor Event Tickets with Ticket Scanner

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.2epss 0.1%
The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected products
Unknown · Event Tickets with Ticket Scanner
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Event Tickets with Ticket Scanner

In the same product, most dangerous first.

CVE-2024-6711LOWEvent Tickets with Ticket Scanner < 2.3.8 - Admin+ Stored XSSEPSS 0.3%CVE-2026-121858MEDIUMEvent Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables SearchEPSS 0.2%CVE-2025-1762MEDIUMEvent Tickets with Ticket Scanner < 2.5.4 - Arbitrary Tickets Deletion via CSRFEPSS 0.2%