Event Tickets and Registration, CVE-2025-11517

CVE, Research URL: CVE-2025-11517
Home page URL: Security reports for Event Tickets and Registration
Application: Event Tickets and Registration
Published on: Oct 18, 2025
Research Description: The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target.
Affected versions: max 5.26.6.
Status: vulnerable