WordPress Plugin Vulnerabilities

Tickera – WordPress Event Ticketing < 3.5.6.5 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update

Description

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_change_ticket_status' AJAX endpoint in all versions up to, and including, 3.5.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update post/event statuses.

Affects Plugins

Plugin icon
tickera-event-ticketing-system
Fixed in 3.5.6.5

References

CVE
CVE-2025-12356
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e7c08b1a-c73d-488c-96df-cf18acb460bb

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Athiwat Tiprasaharn (Jitlada)
Verified
No
WPVDB ID
8444a682-5868-4b5b-8d73-1f0b58fbbeaa

Timeline

Publicly Published
2026-02-17 (about 7 months ago)
Added
2026-02-17 (about 7 months ago)
Last Updated
2026-02-18 (about 7 months ago)

Other

Published
Title
Published
2025-12-12
Title
Employee Spotlight – Team Member Showcase & Meet the Team Plugin < 5.1.4 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out Modification
Published
2024-07-11
Title
Academy LMS < 2.0.5 - Missing Authorization
Published
2025-10-16
Title
Kallyas < 4.23.0 - Missing Authorization
Published
2025-02-27
Title
Cardealer < 1.6.5 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege Escalation
Published
2023-11-07
Title
Dragfy Addons for Elementor <= 1.0.2 - Missing Authorization via save_settings