CVE-2026-110902: Authorization Bypass Through User-Controlled Key in Liquid Web / StellarWP Event Tickets

This vulnerability in the Event Tickets plugin by Liquid Web / StellarWP involves an authorization bypass through a user-controlled key due to incorrectly configured access control security levels. It affects versions from initial releases up to 5.30.1. The issue allows an attacker with low privileges to perform actions that should be restricted, impacting integrity but not confidentiality or availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and unchanged scope.

An attacker with low privileges can bypass authorization controls, potentially modifying or performing actions beyond their intended permissions. This impacts the integrity of the affected system but does not affect confidentiality or availability. There are no reports of active exploitation in the wild.

As no explicit patch or remediation details are provided, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is available, review and tighten access control configurations related to user-controlled keys in the Event Tickets plugin. Monitor vendor communications for updates and apply official patches once released.