CVE-2026-3174

The Event Tickets and Registration plugin for WordPress (all versions up to and including 5.27.4) is missing a capability/authorization check (CWE-862) on its Stripe OAuth return endpoint, leaving that endpoint writable by unauthenticated requests. By sending a crafted request to this network-reachable endpoint, a remote attacker with no account on the site can overwrite the stored Stripe merchant credentials — the access token, publishable key, and account ID. Once the credentials are replaced, all subsequent ticket payments processed through the plugin are diverted into the attacker's own Stripe account; the CVSS vector (C:N/I:H/A:N) reflects the loss of integrity rather than data disclosure. Any WordPress site running the plugin at version 5.27.4 or below is affected, with financial impact concentrated on sites using the plugin's Stripe payment integration. There is no known in-the-wild exploitation or public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a ~0.3% chance of exploitation within 30 days.

What to do: Update the Event Tickets and Registration plugin to the latest patched release (any version above 5.27.4). As a precaution, sites that used Stripe with this plugin should reconnect the Stripe integration, verify the connected account ID in the Stripe dashboard, and revoke/reissue the stored access token and keys. Review recent ticket transactions and payouts for payments routed to an unexpected Stripe account, which would indicate the credentials were already swapped.