The vulnerability is an unauthenticated broken access control flaw in the WordPress Event Tickets plugin versions 5.29.0.1 and earlier. It allows an attacker to reach plugin endpoints that expose event management features without any authentication. Based on the description, it is inferred that an attacker could create, edit or delete tickets, which could disrupt event scheduling and financial record keeping, but the CVE text does not explicitly detail the full range of possible actions.

All installations of the Nexcess WordPress Event Tickets plugin at or below version 5.29.0.1 deployed on WordPress sites are affected. Any WordPress site running these plugin versions is at risk.

The vulnerability carries a CVSS score of 5.3, indicating moderate risk. An EPSS score of < 1% indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog, suggesting it has not yet been actively exploited. Remote exploitation requires only unauthenticated HTTP requests to the plugin’s endpoints, with no special privileges or additional conditions reported. The moderate CVSS score combined with the low EPSS and lack of known active exploitation implies an overall risk level that warrants timely attention.