Tickera WordPress Event Ticketing < 3.4.6.9 - Unauthenticated Sensitive Data Exposure

Description

Due to missing authorization controls in the "admin_init" hooks, all personal data from registered users of an event could be exported into a downloadable PDF file by every unauthenticated user. The event ID could be read from the page source and/or easily enumerated in sequence.

According to the original researcher, "After several attempts to contact the Plugin vendor (Twitter, email), we followed generally accepted disclosure guidelines. A lengthy correspondence with Tickera support was not successful as well."

Edit (WPScanTeam)
April 8th, 2020 - Report Received & Escalated to WP Plugins Team
April 9th, 2002 - v3.4.6.9 released
April 11th, 2020 - Disclosure