Threats tagged 'ghsa-gqcc-52m4-8mqh'

The Event Tickets Manager for WooCommerce WordPress plugin versions before 1.6.0 has a vulnerability where it fails to validate ticket-type prices sent to an unauthenticated AJAX action if the referenced product has no ticket types configured. This flaw allows unauthenticated users to set arbitrary prices, including free, for event tickets site-wide, affecting all subsequent ticket purchases. The issue stems from an incomplete fix of a previous vulnerability (CVE-2026-34898).