The vulnerability is an authentication bypass by spoofing. An attacker can trick the My Tickets plugin into treating an arbitrary user ID as authenticated, effectively impersonating that user. This flaw aligns with CWE‑290, broken authentication, and can lead to unauthorized access to sensitive functions such as ticket management or administrative actions.

The affected systems are installations of the WordPress My Tickets plugin from Joe Dolson up to and including version 2.1.1. These systems can be running on any WordPress site that has installed the plugin, meaning that the risk is widespread across any site using this plugin version.

With a CVSS score of 5.3 and an EPSS below 1 %, the vulnerability presents a moderate severity but is unlikely to see mass exploitation. Based on the description, the likely attack vector is sending a crafted HTTP request to the My Tickets plugin endpoint, which an attacker can perform locally or remotely without privileged access. Attackers can target any site that exposes the plugin’s functions to public or authenticated users. It is inferred that, because the flaw is not listed in the CISA KEV catalog, there has been no widespread exploitation yet, although the issue is actionable.