WordPress Plugin Vulnerabilities

Tickera – WordPress Event Ticketing < 3.5.4.9 - Unauthenticated Customer Data Exposure

Description

The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.5.4.8 via the 'tickera_tickets_info' endpoint. This makes it possible for unauthenticated attackers to extract sensitive data from bookings like full names, email addresses, check-in/out timestamps and more.

Affects Plugins

Plugin icon
tickera-event-ticketing-system
Fixed in 3.5.4.9

References

CVE
CVE-2024-12578
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2db29c12-bf8a-4d5a-b12a-6c74b816d5f0

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Paule, Aaron Schlitt
Verified
No
WPVDB ID
7f973acc-5e8e-488d-b4a2-bccd551e1f18

Timeline

Publicly Published
2024-12-13 (about 1 year ago)
Added
2024-12-13 (about 1 year ago)
Last Updated
2025-01-17 (about 1 year ago)

Other

Published
Title
Published
2021-01-28
Title
uListing < 1.7 - Unauthenticated Information Disclosure
Published
2024-04-16
Title
WP Meta SEO < 4.5.13 - Unauthenticated Password Protected Content Access
Published
2024-08-07
Title
Booking for Appointments and Events Calendar – Amelia < 1.2.1 - Unauthenticated Full Path Disclosure
Published
2024-06-20
Title
WP 2FA < 2.6.4 - Unauthenticated Information Exposure via Log File
Published
2026-09-03
Title
JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset