Threat Overview
A critical authorization bypass vulnerability in the Event Tickets and Registration plugin exposes organizations selling event admissions, workshop passes, and conference registrations to financial theft. A missing capability verification check on the plugin’s Stripe OAuth callback handler allows unauthenticated remote attackers to overwrite the site operator’s active Stripe connection keys, diverting subsequent payment processing into an attacker’s merchant account.
| Threat Metric | Technical Details |
|---|---|
| Severity Rating | CRITICAL (CVSS 9.8 / 10.0) |
| Vulnerability Class | Missing Authorization to Key Overwrite (CWE-862) |
| Vulnerable Component | Event Tickets and Registration (plugin versions up to and including 5.27.4) |
| Attack Vector | Unauthenticated HTTP request to Stripe OAuth return endpoint |
The Breakdown: How the Exploit Works
Event Tickets integrates with payment gateways to process ticket transactions directly on WordPress websites. When establishing a connection with Stripe, the plugin provides an OAuth onboarding route that receives authorization codes and saves publishable keys, secret access tokens, and merchant account IDs into the WordPress options database table.
The vulnerability exists because the OAuth return endpoint fails to verify whether the incoming HTTP request originates from an authenticated administrator with appropriate capabilities. An unauthenticated attacker can craft a direct request to the callback URL containing merchant tokens from their own Stripe account. The plugin accepts the payload and overwrites the legitimate business owner’s payment gateway credentials without validating the session.
The Operational Risk: What an Attacker Gains
Unlike typical code execution exploits that cause noticeable website disruptions, this flaw enables silent financial hijacking:
- Direct Revenue Interception: All subsequent ticket sales and checkout transactions process seamlessly through the attacker’s merchant account, siphoning cash flow while customers receive valid tickets.
- Customer Data Harvest: Customer checkout information and transaction metadata are routed into unauthorized external merchant dashboards.
Our Take in Plain English
“Financial transactions require strict separation of concerns. In traditional dynamic CMS environments, payment gateway credentials and connection hooks live in the same shared database that processes public web requests. When an authorization check is missed on an endpoint, your financial pipeline can be silently re-routed. Modern pre-rendered edge architecture completely isolates checkout flows, delegating payment sessions directly to verified merchant portals and serverless transaction handlers.”
The Modern Architectural Remedy
- Legacy Dynamic WordPress: Stores sensitive API tokens and payment routing keys within the core web application database, where unvetted endpoints can expose them to unauthorized modification.
- Modern Pre-Rendered Architecture: Decouples user-facing event catalog pages from payment execution. Checkout links route directly to hosted payment vaults (e.g., Stripe Checkout) with cryptographically verified webhooks, eliminating local credential tampering risks.
Immediate Action Items for WordPress Operators
- Update Event Tickets: Update the Event Tickets and Registration plugin to version 5.27.5 or higher immediately.
- Verify Connected Stripe Account: Log in to the WordPress dashboard and confirm the connected Stripe Account ID matches your legitimate merchant account.
- Audit Recent Payouts: Review Stripe dashboard payout logs for any unexpected redirection of funds.