This is due to an incomplete fix of CVE-2026-34898.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Event Tickets Manager for WooCommerce | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 09 Nov 2026 07:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-20 CWE-284 |
Mon, 09 Nov 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next event ticket added to any cart, allowing unauthenticated visitors to buy event tickets at an arbitrary price, including for free. This is due to an incomplete fix of CVE-2026-34898. | |
| Title | Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Ticket Price Manipulation | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-09T06:00:28.550Z
Reserved: 2026-11-05T13:13:50.776Z
Link: CVE-2026-123129
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-09T07:17:29.793
Modified: 2026-11-09T07:17:29.793
Link: CVE-2026-123129
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-09T07:30:06Z