CVE-2026-121857

Name of the Vulnerable Software and Affected Versions Event Tickets with Ticket Scanner versions prior to 3.1.14

Description Insufficient capability checks in the plugin allow users with any role granted access to the admin area, including the Subscriber role, to perform unauthorized actions. Specifically, the software fails to verify if a user has the authority to manage WooCommerce orders before returning or removing ticket data. This allows an authenticated attacker to view the names and ticket codes of other customers or remove tickets from orders.

Recommendations Update to version 3.1.14 or later.