CVE-2026-105893: Authorization Bypass Through User-Controlled Key in Liquid Web / StellarWP Event Tickets

This vulnerability in the Event Tickets plugin by Liquid Web / StellarWP allows an attacker to bypass authorization by manipulating user-controlled keys. The flaw exists in versions prior to 5.30.0.2, enabling unauthorized actions due to improper validation of user input. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with no privileges or user interaction needed, impacting integrity but not confidentiality or availability.

An attacker can perform unauthorized actions by exploiting the authorization bypass, potentially modifying data or functionality that should be restricted. The vulnerability does not impact confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific mitigations are provided in the available data.