The missing authorization flaw in the Tickera event ticketing system allows an attacker to access or manipulate ticketing data that should be restricted. This can result in unauthorized viewing, editing, or deletion of event details and ticket records, potentially compromising customer information or event integrity.

The vulnerability affects the Tickera WordPress plugin, versions up to and including 3.5.5.2, which is installed on WordPress sites.

The CVSS score of 4.3 indicates a moderate level of severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation in the wildcarded population. The flaw is not listed in CISA’s KEV catalog. The most plausible attack vector is an authenticated user with improper role configuration or a local administrator exploiting incorrect access control checks within the plugin’s endpoints. Based on the description, the required privileges are likely lower than fully privileged accounts, but the specific conditions are not detailed.