CVE-2025-11517
|
| |
|
|
Software afectado |
WORDPRESS |
|
|
|
The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2025-11517 |
