CVE-2026-16067

This CVE exposes a price validation bypass in the native checkout flow of an event ticketing plugin that also supports WooCommerce integration. If your site uses the plugin's standalone checkout rather than WooCommerce checkout, an attacker can submit arbitrary price values and obtain tickets for free or at manipulated costs. The vulnerability is straightforward: the native checkout path trusts client-supplied price parameters instead of re-deriving the ticket price server-side from your event configuration. The WooCommerce-integrated path does this correctly — prices come from the cart and are validated by the payment gateway — but the separate native path was built without that enforcement layer. Check whether native checkout is enabled in your plugin settings. If it is, treat this as financially critical regardless of the CVSS 5.3 score, because exploitation is deterministic: anyone who sends the right payload gets free tickets. There is no rate limiting or anomaly detection mentioned in the disclosure that would catch this in flight. The patch adds server-side price re-derivation to the native checkout flow — verify you're on the patched version and audit your transaction logs for zero-cost or heavily discounted ticket orders as a one-time check for prior exploitation. If you cannot patch immediately, disable native checkout and route all purchases through WooCommerce, which retains the correct validation behavior. The EPSS score of 0.00236 reflects that automated scanning won't find this — exploitation requires understanding the plugin's specific checkout parameters and having valid event IDs — but the deterministic financial impact means the actual risk to your operation is higher than generic scoring suggests.

Reviewed through automated stages and approved by a human before publication.