This is due to an incomplete fix of CVE-2026-34898.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Event Tickets Manager for WooCommerce | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Mon, 09 Nov 2026 07:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-20 CWE-284 |
Mon, 09 Nov 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next event ticket added to any cart, allowing unauthenticated visitors to buy event tickets at an arbitrary price, including for free. This is due to an incomplete fix of CVE-2026-34898. | |
| Title | Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Ticket Price Manipulation | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-09T14:12:16.231Z
Reserved: 2026-11-05T13:13:50.776Z
Link: CVE-2026-123129
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-09T07:17:29.793
Modified: 2026-11-09T07:17:29.793
Link: CVE-2026-123129
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-09T07:30:06Z