CVE-2025-64257

The My Tickets plugin for WordPress versions up to and including 2.1.0 suffers from a missing authorization vulnerability. This broken access control issue means that certain functions lack proper authorization checks, allowing users with lower privileges to perform actions intended for higher-privileged roles [1].

Attackers can exploit this by sending crafted requests to the vulnerable endpoints without needing authentication or with minimal privileges. The vulnerability is particularly concerning because it can be used in mass-exploit campaigns targeting thousands of WordPress sites [1].

Successful exploitation could allow an attacker to execute actions that should be restricted, such as modifying ticket settings or accessing sensitive data, depending on the specific missing authorization. The CVSS score of 4.3 indicates a medium severity, but the vendor notes it is unlikely to be exploited in practice [1].

The issue is patched in version 2.1.1. Users are strongly advised to update immediately. For those unable to update, consulting a hosting provider or web developer is recommended. Patchstack users can enable auto-updates for vulnerable plugins [1].