Unauthenticated Stripe Credential Overwrite in WordPress Event Tickets Plugin

CVE-2026-3174 is a critical authorization vulnerability affecting the 'Event Tickets and Registration' plugin for WordPress in all versions up to and including 5.27.4. The vulnerability stems from a missing capability check on the Stripe OAuth return endpoint. By exploiting this flaw, an unauthenticated attacker can send crafted requests to the plugin's Stripe integration flow. Because the application fails to verify the identity of the requester, the attacker can overwrite the site's legitimate Stripe merchant credentials - specifically the Stripe access tokens, publishable keys, and account ID - with their own. Consequently, all subsequent financial transactions processed by the site will be directed to the attacker's account rather than the merchant's. This vulnerability represents a direct financial risk to organizations using the plugin to collect ticket payments, as it allows for the complete diversion of revenue without requiring administrative access to the WordPress environment.

Impact

Successful exploitation allows attackers to perform full financial fraud by redirecting payment traffic to arbitrary Stripe accounts. This impacts any organization using the Event Tickets and Registration plugin for commerce. Potential consequences include total loss of revenue from ticket sales, compromise of customer payment flows, and significant reputational damage.

Recommendation

Prioritized actions for security teams:

• Update the 'Event Tickets and Registration' plugin to a version patched against CVE-2026-3174 immediately.
• Audit the WordPress 'wp_options' or equivalent plugin configuration tables for unexpected changes to Stripe account IDs, publishable keys, or API credentials.
• Review recent transaction logs within the WordPress environment and Stripe dashboard for anomalies in payment routing.