The My Tickets – Accessible Event Ticketing WordPress plugin contains a flaw in the mt_save_profile function that fails to enforce proper access control when updating user roles. Because the function does not restrict which users may change role values, an authenticated user who has Subscriber level access or higher can change the role field to Administrator, elevating their privileges to full site control. This vulnerability is a classic example of a privilege escalation weakness (CWE‑269).

WordPress sites that have installed the My Tickets – Accessible Event Ticketing plugin from the vendor joedolson, in any version up to and including 2.0.16. The plugin is commonly employed to manage event tickets, and any site running these versions is potentially affected.

The CVSS base score of 8.8 reflects the high severity of the flaw, whereas the EPSS score of less than 1% indicates that exploitation is currently unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers need only valid credentials with Subscriber‑level permissions or higher; the attack path consists of sending a normal profile update request that modifies the role field. No additional network or system prerequisites are required, making the exploitation straightforward for any authenticated user who discovers the issue.