The Tickera – Sell Tickets & Manage Events plugin for WordPress contains a missing capability check on the wp_ajax_change_ticket_status AJAX endpoint. This flaw allows authenticated users with Subscriber-level access to invoke the endpoint and update the status of events or posts. The vulnerability is classified as CWE‑862, Missing Authorization.

All versions of the Tickera plugin up to and including 3.5.6.4 are affected. Any WordPress site that installs one of these releases of the plugin is at risk. The flaw is isolated to the plugin and does not involve other WordPress components.

The CVSS score of 4.3 indicates a low‑moderate risk level. The EPSS score of less than 1% suggests that exploitation is expected to be rare. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that an attacker be logged in as a Subscriber; the attacker can issue an Ajax request to the vulnerable endpoint, and the absence of a capability check allows the request to succeed.