CVE-2026-14822— Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Event Tickets and Registration | < 5.29.0.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14822
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation
Source: CVE Program / CVE List V5
Vulnerability Description
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Event Tickets and Registration | 0 ~ 5.29.0.1 | - |
II. Public POCs for CVE-2026-14822
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14822
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14822 (1)
- 🔗 Event Tickets < 5.29.0.1 – Unauthenticated PayPal Order Status Manipulation | CVE 2026-14822 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-01 · 30 CVEs total
| CVE-2026-13604 | Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX | |
| CVE-2025-15669 | Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label | |
| CVE-2026-12966 | Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering v | |
| CVE-2026-15932 | Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal | |
| CVE-2026-14309 | Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass | |
| CVE-2026-14596 | DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Lin | |
| CVE-2026-14836 | Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limi | |
| CVE-2026-14197 | Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR | |
| CVE-2026-15244 | HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File In | |
| CVE-2026-15368 | Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registrat | |
| CVE-2026-15234 | Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute | |
| CVE-2026-15262 | Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column | |
| CVE-2026-13157 | Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload | |
| CVE-2026-13158 | Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload | |
| CVE-2026-10827 | Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via B | |
| CVE-2026-14840 | YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing | |
| CVE-2026-13596 | Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search | |
| CVE-2026-13329 | WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund | |
| CVE-2026-12696 | wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field | |
| CVE-2026-11882 | Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Event Tickets and Registration
- CVE-2026-14823
Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and T - CVE-2026-14819
Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move - CVE-2025-11517
Event Tickets and Registration <= 5.26.5 - Unauthenticated T - CVE-2025-1402
Event Tickets and Registration <= 5.19.1.1 - Missing Authori - CVE-2024-13457
Event Tickets <= 5.18.1 - Insecure Direct Object Reference t
Same vendor: Unknown
- CVE-2026-16565
Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modif - CVE-2026-16572
LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' C - CVE-2026-16300
Chama < 1.0.13 - Unauthenticated Arbitrary User Password Res - CVE-2026-16563
Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content D - CVE-2026-16564
Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification
V. Comments for CVE-2026-14822
No comments yet