CVE Alert: CVE-2025-11517 – theeventscalendar – Event Tickets and Registration

Risk verdict: High risk due to unauthenticated bypass of paid ticket payments on a publicly accessible REST endpoint; CVSS indicates high impact but there is no evidence of active exploitation in the data provided.

Why this matters: Attackers can obtain paid tickets without payment, directly eroding revenue and undermining trust in the ticketing flow. Coupled with automation potential, a lightweight, repeatable attack can affect multiple sites using the same plugin.

Most likely attack path: An unauthenticated attacker targets the REST endpoint for free-ticket purchases, exploiting no user interaction and no privileges required. The route operates with low complexity and is network-accessible, enabling rapid, automated attempts to obtain zero-cost tickets and generate fraudulent traffic or refunds.

Who is most exposed: Publicly accessible WordPress sites running event/ticketing functionality, especially those with the plugin installed and exposed REST endpoints to unauthenticated users.

Detection ideas:

• Unusual spikes in free-ticket orders or zero-value transactions without corresponding payment records.
• Repeated unauthenticated requests to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint.
• Mismatches between ticket issuance and payment gateway logs.
• Anomalous IPs or user agents interacting with the ticket REST endpoint.
• Revenue reconciliation anomalies after events or promotions.

Mitigation and prioritisation:

• Patch to version 5.26.6 or newer; apply vendor-supplied fix promptly.
• If patching is not feasible, implement a WAF rule to block or require authentication for the free-order endpoint.
• Disable or restrict free-order flow until patched; implement stricter input validation and access controls.
• Monitor, alert, and log: revenue discrepancies, endpoint access, and user-agent patterns; perform regular reconciliation.
• Change-management: test in staging before production rollout; communicate upgrade windows.

If KEV is true or EPSS ≥ 0.5, treat as priority 1.