The Event Tickets and Registration WordPress plugin fails to enforce proper authorization on certain seating-related operations. Users with contributor or higher privileges can modify the seating layout, ticket inventory, and seat assignments for events they do not own, effectively rewriting event data. This flaw exposes the integrity of event configurations and ticket counts, potentially allowing attackers to inflate or deflate ticket availability and misassign or duplicate seats, leading to inventory mismatch and denial of service for legitimate attendees.

The vulnerability affects the Event Tickets and Registration WordPress plugin versions earlier than 5.29.0.1. Any deployment that has installed the plugin at a version below the listed threshold is susceptible, regardless of the hosting environment or other WordPress components.

The flaw is an IDOR (Insecure Direct Object Reference) with a low exploitation probability, reflected by an EPSS score of less than 1% and no listing in the CISA KEV catalog. The CVSS score of 2.2 indicates low severity. While the attack surface requires authenticated access as a contributor or higher, the web-based nature of the actions suggests that an attacker who can log into the site can target specific event IDs. No public exploit code is documented, so the risk is limited to sites that have not applied the patch yet.