CVE-2025-11517

Name of the Vulnerable Software and Affected Versions Event Tickets and Registration plugin for WordPress versions prior to 5.26.6

Description The Event Tickets and Registration plugin for WordPress has a flaw that allows bypassing payment for tickets. The /wp-json/tribe/tickets/v1/commerce/free/order API endpoint does not properly verify if a ticket type should be free, enabling attackers to acquire paid tickets without payment. This impacts revenue for the target. The issue allows unauthenticated attackers to obtain access to paid tickets without paying.

Recommendations Update Event Tickets and Registration plugin for WordPress to version 5.26.6 or later.