CVE-2026-121857mediumCWE-863

CVE-2026-121857: fallo de gravedad media en Event Tickets with Ticket Scanner

Event Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend

Publicada el

Seguir esta CVE+ Monitorear Event Tickets with Ticket Scanner

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 4.2epss 0.1%
The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Productos afectados
Unknown · Event Tickets with Ticket Scanner
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Event Tickets with Ticket Scanner

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-6711LOWEvent Tickets with Ticket Scanner < 2.3.8 - Admin+ Stored XSSEPSS 0.3%CVE-2026-121858MEDIUMEvent Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables SearchEPSS 0.2%CVE-2025-1762MEDIUMEvent Tickets with Ticket Scanner < 2.5.4 - Arbitrary Tickets Deletion via CSRFEPSS 0.2%