CVE-2026-3174: 
WordPress vulnerability analysis and mitigation

CVE-2026-3174 is a Missing Authorization vulnerability in the Event Tickets and Registration plugin for WordPress (by StellarWP/The Events Calendar), affecting all versions up to and including 5.27.4. The flaw allows unauthenticated attackers to overwrite the site's Stripe merchant credentials — including access tokens, publishable keys, and account IDs — by exploiting an unprotected Stripe OAuth return endpoint, thereby diverting all subsequent payment processing to the attacker's Stripe account. It was published on September 8, 2026, with a patch available as of the same date. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Wordfence).

The root cause is a missing capability check (CWE-862) on the Stripe OAuth return endpoint (Return_Endpoint.php, line 50) within the plugin's commerce gateway integration. Because no authentication or authorization is enforced on this endpoint, any unauthenticated network request can trigger the credential-overwrite logic in Merchant.php (line 208), replacing the legitimate site owner's Stripe OAuth tokens with attacker-controlled values. No special privileges, user interaction, or complex conditions are required — the attack is fully automatable over the network. The relevant source code is publicly browsable in the WordPress plugin repository (GitHub Advisory, Return_Endpoint.php, Merchant.php).

Successful exploitation allows an unauthenticated attacker to silently redirect all payment processing from the victim WordPress site to the attacker's own Stripe account, resulting in direct financial theft from customers and the site operator. There is no confidentiality or availability impact to the WordPress installation itself, but the integrity of payment credentials is fully compromised. Victims may not detect the diversion until they notice missing revenue or receive customer complaints, potentially resulting in significant financial and reputational damage (GitHub Advisory, Wordfence).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The attack is classified as automatable (no user interaction required), making it attractive for mass scanning campaigns. The EPSS score is approximately 0.264% (18th percentile), indicating a relatively low but non-negligible probability of exploitation within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Event Tickets and Registration plugin (versions ≤ 5.27.4) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at /wp-content/plugins/event-tickets/readme.txt.
2. Locate the vulnerable endpoint: Identify the Stripe OAuth return REST endpoint exposed by the plugin (e.g., a WordPress REST API route registered by Return_Endpoint.php).
3. Craft a malicious OAuth callback request: Construct an HTTP request mimicking a legitimate Stripe OAuth callback, supplying attacker-controlled values for the Stripe access token, publishable key, and account ID parameters.
4. Submit the request unauthenticated: Send the crafted request to the vulnerable endpoint without any authentication headers or cookies. Because no capability check is performed, the plugin processes the request and overwrites the stored Stripe merchant credentials with the attacker's values.
5. Collect diverted payments: All subsequent ticket purchases processed through the site's Stripe integration are now routed to the attacker's Stripe account, with victims unaware of the diversion (GitHub Advisory, Return_Endpoint.php).

• Logs: WordPress access logs showing unexpected unauthenticated POST or GET requests to the Stripe OAuth return REST API endpoint (e.g., /wp-json/tribe/tickets/v1/commerce/stripe/... or similar) from unknown IP addresses.
• Database: Changes to WordPress options or plugin-specific database entries storing Stripe credentials (access_token, publishable_key, account_id) that do not correspond to a legitimate admin re-authorization event.
• Stripe Dashboard: Unexpected Stripe account connections or OAuth authorizations visible in the Stripe developer dashboard; payment transactions appearing in an unrecognized Stripe account.
• File System: No file-level indicators expected, as the attack operates entirely through the REST API and database writes.
• Network: Outbound OAuth callback traffic to Stripe originating from the web server at unusual times or without a corresponding admin session (Wordfence).

Update the Event Tickets and Registration plugin to a version newer than 5.27.4, which includes the fix applied in changeset 3472837. Immediately after patching, verify your Stripe OAuth credentials and account settings in both the WordPress plugin settings and the Stripe dashboard to confirm they have not been tampered with. Review recent transaction history for any unauthorized payment diversions. If immediate patching is not possible, consider temporarily disabling the plugin or blocking unauthenticated access to the Stripe OAuth REST endpoint via a WAF rule or server-level access control (GitHub Advisory, Plugin Changeset).

The vulnerability was reported and disclosed by Wordfence, which published a threat intelligence entry on September 8, 2026. Social media activity was limited, with a brief mention on Mastodon by RedPacketSecurity. No significant vendor statements beyond the patch release or notable researcher commentary beyond the Wordfence disclosure have been identified (Wordfence).