Medium severity5.3NVD Advisory· Published Jan 30, 2025· Updated Jun 17, 2026
CVE-2024-13457
CVE-2024-13457
Description
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the tc-order-id parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view order details of orders they did not place, which includes ticket prices, user emails and order date.
Affected products
4<=5.18.1+ 1 more
- (no CPE)range: <=5.18.1
- (no CPE)
- stellarwp/Event Tickets and Registrationv5Range: 0
Patches
Vulnerability mechanics
References
2- plugins.trac.wordpress.org/changesetnvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/0cc2261a-889e-40ec-8382-48de65b91b34nvdThird Party Advisory
News mentions
0No linked articles in our index yet.