CVE-2026-110902— WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability
Quick assessment
Affected
Liquid Web / StellarWP Event Tickets
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Liquid Web / StellarWP 的 Event Tickets 插件（event-tickets）存在“通过用户可控键绕过授权”的漏洞，攻击者可利用该漏洞绕过错误配置的访问控制安全级别。此漏洞影响 Event Tickets 插件从未知版本起至 5.30.1 版本。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Liquid Web / StellarWP | Event Tickets | ≤ 5.30.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110902
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Liquid Web / StellarWP | Event Tickets | 0 ~ 5.30.1 | - |
|
II. Public POCs for CVE-2026-110902
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110902
请登录查看更多情报信息。
Other References for CVE-2026-110902 (1)
IV. Related Vulnerabilities
Same product: Event Tickets
-
CVE-2026-105893
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access C -
CVE-2026-105891
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access C -
CVE-2026-105888
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access C -
CVE-2026-104675
WordPress Event Tickets plugin <= 5.30.0 - Broken Access Con -
CVE-2026-97287
WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vul
Same vendor: Liquid Web / StellarWP
-
CVE-2026-111396
WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Acc -
CVE-2026-110903
WordPress The Events Calendar plugin <= 6.18.1 - Cross Site -
CVE-2026-110900
WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control v -
CVE-2026-96333
WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnera -
CVE-2026-105893
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access C
Same weakness: CWE-639
-
CVE-2026-112294
FlyCms through commit edfdf724 Missing Authorization via Act -
CVE-2026-112287
Krayin CRM before 2.2.7 Broken Object Level Authorization in -
CVE-2026-112286
Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Produ -
CVE-2026-111939
Frappe Helpdesk before 1.26.0 Authorization Bypass via raise -
CVE-2026-112043
calcom cal.com/cal.diy Webhook util.ts createWebhookProcedur
V. Comments for CVE-2026-110902
No comments yet