The Event Tickets and Registration plugin lacks a capability check on the ajax_ticket_delete function, allowing any authenticated user with Contributor-level privileges or higher to delete any attendee ticket. An attacker who is logged into the WordPress site can trigger this deletion via the exposed AJAX endpoint, potentially erasing event registration data and causing financial loss or operational disruption for event organizers. The flaw is a missing authorization check corresponding to CWE‑862.

The vulnerability affects the WordPress plugin Event Tickets and Registration by StellarWP, specifically all releases up to and including version 5.19.1.1. All users of these affected plugin versions on any WordPress site are at risk.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw only requires authenticated Contributor access, attackers who gain such a role on a site—whether through credential compromise or internal abuse—can exploit it without needing higher administrative privileges, making the risk tangible to sites with many contributor accounts.