Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-97634 · Microsoft / collected KEV context

cve-program · CVE-2026-97634

• https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf2625a-3fb4-40c3-80e3-2f03fbff6bfd?source=cve
• https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Repositories/Order_Repository.php#L603
• https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/common/src/Tribe/Repository/Query_Filters.php#L992
• https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Repositories/Order_Repository.php#L696
• https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Repositories/Order_Repository.php#L822
• https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Admin_Tables/Orders.php#L157
• https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.29.5/src/Tickets/Commerce/Reports/Orders.php#L253
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3711578%40event-tickets&new=3711578%40event-tickets

No related operational record is retained in the current change model.