The My Tickets plugin version 2.1.0 or earlier contains an insertion of sensitive information into sent data flaw (CWE‑201) that allows attackers to retrieve embedded sensitive data. The plugin fails to filter or omit confidential fields when assembling responses, enabling unauthorized disclosure of private information. An attacker who can send crafted requests to the plugin’s endpoints can read personal or transaction data that should remain confidential, resulting in a confidentiality breach.

The vulnerability affects the WordPress My Tickets plugin developed by Joe Dolson. All releases from the plugin’s inception through version 2.1.0 are impacted. Site owners who have deployed any version of the plugin in a WordPress environment are susceptible if those deployments expose the plugin’s functionality to unauthenticated or unauthorized visitors.

The security assessment reports a CVSS base score of 7.5, indicating high severity. The EPSS score is below 1%, implying a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog, suggesting no documented widespread attacks. Based on the description, it is inferred that an adversary can trigger the data exposure by sending requests to the plugin’s web endpoints, allowing anyone with site access to retrieve sensitive information.