PT-2026-58093 · WordPress · Hi.Events

Adam Młynarczyk · Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-60118

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hi.Events versions prior to 1.11.0

Description Missing server-side visibility enforcement allows unauthenticated attackers to purchase hidden tickets. By referencing hidden product and price IDs in order creation requests, attackers can bypass authorization checks. This is possible by enumerating sequential hidden ticket IDs based on visible ones to acquire VIP, invite-only, or discounted tickets that were intentionally withheld from public sale.

Recommendations Update Hi.Events to version 1.11.0 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-60118

GHSA-2H54-CPRV-VJ74

Affected Products

Hi.Events

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60118.json · Exploit
• https://github.com/HiEventsDev/Hi.Events/commit/9eec95e6176f500b71bf633986243045ca78cefb · Patch
• https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2h54-cprv-vj74 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-60118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-60118 · Security Note
• https://github.com/HiEventsDev/Hi.Events · Note
• https://github.com/HiEventsDev/Hi.Events/releases/tag/v.1.11.0-beta · Note
• https://github.com/HiEventsDev/Hi.Events/pull/1259 · Note
• https://vulncheck.com/advisories/hi-events-beta-hidden-ticket-enumeration-via-order-creation-endpoint · Note