Missing authorization in the Event Tickets plugin allows a user to bypass the intended access controls and perform actions or view data that should be restricted. Specifically, the flaw permits exploitation of incorrectly configured security levels, letting an attacker gain privileges to access or modify event information. Because the plugin is commonly used on WordPress sites, the impact may include viewing sensitive event details or manipulating event settings.

The vulnerability affects the Liquid Web / StellarWP Event Tickets plugin. All installations using version 5.30.2 or earlier are vulnerable. Affected systems include any WordPress installation that has the plugin installed at those versions, regardless of whether the site hosts public events or internal. The CNA vendor lists the product as Event Tickets, not specifying particular WordPress setups.

With a CVSS score of 4.3, the severity is moderate. The EPSS score is not available, so exploitation likelihood is unknown, and the vulnerability is not included in the CISA KEV catalog. The likely attack vector is a remote web‑based request to the plugin's endpoints, possibly targeting unauthenticated users or users with misassigned roles. The lack of code execution or privilege escalation limits the damage to unauthorized data access and manipulation, but the data exposed can include private event details and attendee information.