CVE-2026-104675: Missing Authorization in Liquid Web / StellarWP Event Tickets

This vulnerability in the Event Tickets plugin by Liquid Web / StellarWP is due to missing authorization checks, which results in incorrectly configured access control security levels. Versions from initial releases up to 5.30.0 are affected. An attacker with low privileges can exploit this flaw to perform unauthorized actions that affect the integrity of the system. There is no indication of confidentiality or availability impact. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

The vulnerability allows an attacker with low privileges to bypass access controls and perform unauthorized actions that compromise data integrity within the Event Tickets plugin. There is no impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or advisory link is provided, users should monitor Liquid Web / StellarWP communications for updates and apply any forthcoming patches promptly. Until then, restrict user privileges to the minimum necessary to reduce risk.