The vulnerability is an insecure direct object reference (IDOR) that allows an attacker to bypass authorization by manipulating user‑controlled keys. This flaw enables unauthorized access to event ticket data and the ability to perform actions that a user should not have permission for. The weakness is identified by CWE‑639, which highlights improper enforcement of access controls.

The affected product is the WordPress Event Tickets plugin, distributed by Liquid Web and StellarWP. All releases up to and including version 5.30.1 are vulnerable.

The CVSS score of 4.3 indicates a low‑to‑moderate severity, and the EPSS score is unavailable, implying no known high exploitation probability. The vulnerability is not listed in CISA KEV. Likely attack vectors involve an authenticated user who crafts request URLs or payloads referencing objects they do not own, exploiting the plugin’s lack of ownership checks.