CVE-2026-3174 is a missing authorization vulnerability (CWE-862) in the Event Tickets and Registration WordPress plugin by stellarwp. The flaw exists because the Stripe OAuth return endpoint lacks a capability check, enabling unauthenticated attackers to modify Stripe merchant credentials such as access tokens, publishable keys, and account IDs. This can lead to diversion of payment processing to attacker-controlled Stripe accounts. The vulnerability affects all versions up to and including 5.27.4. There is no vendor advisory or patch information available at this time.

An attacker can overwrite the legitimate Stripe merchant credentials used by the site, causing all subsequent payments to be redirected to the attacker's Stripe account. This results in a complete compromise of payment processing integrity, potentially causing financial loss to the site owner. The vulnerability does not impact confidentiality or availability directly but has a high impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Stripe OAuth return endpoint if possible, and monitor for unauthorized changes to Stripe credentials. Avoid using vulnerable versions in production environments.