Event Tickets Manager for WooCommerce price manipulation
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA.
Summary
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured. The submitted price is stored site-wide and applied to the next event ticket added to any cart, so an unauthenticated visitor can buy event tickets at an arbitrary price, including for free. An exploit is linked in the references. This is due to an incomplete fix of CVE-2026-34898.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Description from the CNA
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next event ticket added to any cart, allowing unauthenticated visitors to buy event tickets at an arbitrary price, including for free. This is due to an incomplete fix of CVE-2026-34898.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Event Tickets Manager for WooCommerce | 1.5.4 to before 1.6.0 | 1.6.0 | Patch available | CNA |
- Event Tickets Manager for WooCommerce VendorUnknown Affected 1.5.4 to before 1.6.0 Fixed in 1.6.0 Patch available CNA
Remediation
Update Event Tickets Manager for WooCommerce to version 1.6.0 or later, which is the fixed version listed for the affected range from 1.5.4 before 1.6.0.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
- Fix · CNA Event Tickets Manager for WooCommerce (Unknown) Fixed in 1.6.0
Timeline
- 2026-11-09 Threatist record created from CVE-2026-123129
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences