CVE-2026-65567: 
WordPress vulnerability analysis and mitigation

CVE-2026-65567 is an Unauthenticated Broken Access Control vulnerability in the Event Tickets WordPress plugin (by StellarWP/Nexcess) affecting versions 5.29.0.1 and earlier. It allows unauthenticated remote attackers to modify event ticket data without any credentials or user interaction. The vulnerability was published on July 27, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform proper authorization checks before allowing certain actions on event ticket data. An unauthenticated attacker can send crafted network requests to trigger restricted functionality without presenting any credentials. The attack requires low complexity and no user interaction, making it straightforward to exploit over the network. No detailed technical write-up or public proof-of-concept code has been identified at this time (GitHub Advisory, Patchstack).

Successful exploitation allows an unauthenticated attacker to modify event ticket information on affected WordPress sites, resulting in a low integrity impact with no confidentiality or availability impact. This could enable unauthorized changes to ticket data, potentially disrupting event management workflows or enabling ticket fraud. The scope is limited to the affected component and does not extend to the broader system (GitHub Advisory).

Site administrators should update the Event Tickets plugin to a version newer than 5.29.0.1 as soon as a patched release becomes available. As an interim measure, implement network access controls to restrict access to the WordPress installation and review recent event ticket data for any unauthorized modifications. The patch is referenced via GitHub Advisory GHSA-j9rv-h4v3-795f (GitHub Advisory, Patchstack).