CVE-2024-13457
📋 TL;DR
The Event Tickets and Registration WordPress plugin has an Insecure Direct Object Reference vulnerability that allows unauthenticated attackers to view order details they shouldn't access. Attackers can see ticket prices, user emails, and order dates from other users' orders. All WordPress sites using this plugin up to version 5.18.1 are affected.
💻 Affected Systems
- Event Tickets and Registration WordPress plugin
📦 What is this software?
Event Tickets by Liquidweb
⚠️ Risk & Real-World Impact
Worst Case
Mass data breach exposing all order information including user emails, ticket prices, and order dates, potentially leading to privacy violations, targeted phishing attacks, and business intelligence theft.
Likely Case
Unauthorized access to individual order details, exposing personal information of event attendees and potentially revealing pricing structures.
If Mitigated
Limited exposure if proper access controls and monitoring are in place, with only minimal data leakage before detection.
🎯 Exploit Status
Exploitation requires manipulating the tc-order-id parameter, which is straightforward for attackers with basic web testing knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.18.1.1
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Event Tickets and Registration' plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 5.18.1.1 from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the vulnerable plugin until patched
wp plugin deactivate event-tickets
Web Application Firewall Rule
allBlock requests containing tc-order-id parameter manipulation
Add WAF rule to block or sanitize tc-order-id parameter
🧯 If You Can't Patch
- Implement strict access controls and monitoring for order data endpoints
- Deploy web application firewall with IDOR protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Event Tickets and Registration → Version number. If version is 5.18.1 or lower, you are vulnerable.Check Version:
wp plugin get event-tickets --field=versionVerify Fix Applied:
After updating, verify plugin version shows 5.18.1.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to order endpoints
- Multiple failed order ID attempts
- Access to order IDs outside normal sequence
Network Indicators:
- HTTP requests with manipulated tc-order-id parameters
- Unusual traffic to /wp-content/plugins/event-tickets/ endpoints
SIEM Query:
source="web_logs" AND (uri_path="*event-tickets*" OR uri_path="*tc-order-id*") AND (status_code=200 OR status_code=403) | stats count by src_ip, uri_path