Missing authorization in the Tickera event ticketing system allows an attacker to bypass access controls and perform unauthorized operations within the plugin, enabling intrusion into event booking data. The flaw can compromise confidentiality and integrity by letting a user read or modify tickets or event details that should be restricted.

WordPress sites that host the Tickera plugin version 3.5.6.4 or earlier. The vulnerability affects the Tickera:Tickera product and any deployment using these plugin versions.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% points to a low exploitation probability. The issue is not listed in the CISA KEV catalog, suggesting no confirmed exploits. The likely attack vector is remote via HTTP requests to the plugin’s endpoints; any user who can send crafted requests to the affected WordPress installation may trigger the broken access control. Overall, the risk is moderate but the probability of exploitation is low.