Description

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site's Stripe merchant credentials (access tokens, publishable keys, and account ID), diverting all subsequent payment processing to the attacker's Stripe account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-08T12:16:54.620Z",
  "pubdate": "2026-09-08T12:16:54.620Z",
  "executiveSummary": "The Event Tickets and Registration plugin for WordPress is susceptible to an unauthorized data modification vulnerability affecting Stripe integration settings.\nThis security flaw stems from a missing capability check on the plugin's Stripe OAuth return endpoint, allowing unauthenticated remote attackers to perform unauthorized configuration updates.\nBy manipulating the OAuth process, an attacker can overwrite critical merchant credentials, specifically replacing legitimate Stripe account IDs, publishable keys, and access tokens with attacker-controlled data.\nThe impact of this vulnerability is severe, as it facilitates a complete compromise of the payment workflow for affected websites.\nPost-exploitation, all financial transactions processed through the vulnerable plugin are redirected to the attacker's Stripe account, resulting in direct financial theft and the compromise of sensitive payment metadata.\nThis vulnerability affects all versions of the Event Tickets and Registration plugin up to, and including, 5.27.4.\nGiven that no authentication is required to interact with the vulnerable endpoint, the risk is classified as critical, requiring immediate attention from site administrators.",
  "technicalDetails": "The vulnerability resides within the Stripe integration module of the Event Tickets and Registration plugin, specifically concerning the handling of the OAuth callback mechanism.\nThe root cause is a failure to implement proper access control mechanisms, specifically a missing capability check (e.g., 'manage_options' or equivalent), on the endpoint designed to process the Stripe OAuth return.\nIn a secure implementation, an OAuth callback endpoint must verify the session state and the authorization level of the user initiating the request before updating site-wide configuration options.\nBecause the plugin fails to enforce these checks, an unauthenticated attacker can craft a malicious request directed at the Stripe OAuth return endpoint. By supplying their own OAuth parameters, an attacker forces the plugin to overwrite existing database records associated with the Stripe merchant configuration.\nThe attack flow proceeds as follows: First, the attacker identifies the URI of the Stripe OAuth return endpoint. Second, the attacker initiates a crafted request to this endpoint containing their own Stripe application identifiers. Third, because the endpoint lacks server-side validation of the requester's identity or administrative permissions, the application processes the input as a legitimate callback.\nThe plugin then performs a database update, replacing the legitimate merchant's Stripe access tokens, publishable keys, and unique account IDs with those provided by the attacker.\nThis results in a total hijacking of the payment processing logic. Subsequent customers attempting to complete transactions through the plugin will unknowingly route payments directly into the attacker's account, bypassing the legitimate site owner entirely.\nThe vulnerability is exposed to the public network, requiring no prior authentication or administrative privileges to exploit. The behavior is limited to the modification of the Stripe configuration, but the downstream financial impact constitutes a complete loss of integrity and confidentiality regarding payment transaction processing.\nThe affected versions include all releases up to and including 5.27.4. The vulnerability is triggered during the callback phase of the OAuth handshake, which is a standard part of the plugin's integration configuration. Because the plugin logic assumes that the incoming callback is always legitimate and originated from a verified administrator's configuration process, it fails to inspect the request context, leaving the system open to this unauthorized state change."
}