Event Tickets and Registration Payment Bypass Vulnerability

A payment bypass vulnerability has been identified in the Event Tickets and Registration plugin for WordPress, affecting all versions through 5.26.5. The vulnerability arises because the '/wp-json/tribe/tickets/v1/commerce/free/order' endpoint fails to properly verify whether a ticket type should be free. This oversight allows users to bypass payment for paid tickets, enabling unauthenticated attackers to gain access to these tickets without payment, resulting in potential revenue loss for the target.

Impact

Exploitation of this vulnerability allows unauthenticated users to access paid tickets without payment, causing a direct loss of revenue.

Remediation

Users are advised to update the Event Tickets and Registration plugin to version 5.26.6 or a newer patched version.