CVE-2026-3174: CWE-862 Missing Authorization in stellarwp Event Tickets and Registration
Description
The Event Tickets and Registration plugin for WordPress has a missing authorization vulnerability in its Stripe OAuth return endpoint. This flaw affects all versions up to and including 5.27.4 and allows unauthenticated attackers to overwrite the site's Stripe merchant credentials. Exploitation can redirect payment processing to an attacker-controlled Stripe account.
CVSS v3.1
Score 7.5high
Affected software
stellarwp
Event Tickets and Registration
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-3174 is a missing authorization (CWE-862) vulnerability in the Event Tickets and Registration WordPress plugin by stellarwp. The vulnerability exists because the Stripe OAuth return endpoint lacks a capability check, allowing unauthenticated attackers to modify Stripe merchant credentials such as access tokens, publishable keys, and account IDs. This enables attackers to divert payment processing to their own Stripe accounts. The issue affects all versions up to and including 5.27.4.
Potential Impact
An attacker can overwrite the legitimate Stripe merchant credentials with their own, causing all subsequent payments processed through the site to be redirected to the attacker's Stripe account. This results in a high integrity impact with no confidentiality or availability impact reported.
Mitigation Recommendations
No patch links or vendor advisory are provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Stripe OAuth return endpoint and monitor for unauthorized changes to Stripe credentials.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-02-24T23:47:23.549Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a9ff394acd9273b49949e2a
Added to database: 09/08/2026, 11:37:56 UTC
Last enriched: 09/16/2026, 02:29:20 UTC
Last updated: 10/23/2026, 15:10:12 UTC
Views: 56
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.