CVE-2025-67939
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tickera | tickera_event_ticketing_system | to 3.5.6.2 (inc) |
| tickera | tickera_event_ticketing_system | 3.5.6.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-67939 is a Broken Access Control vulnerability in the WordPress Tickera plugin (up to version 3.5.6.2). It occurs due to missing authorization, authentication, or nonce token checks in certain plugin functions. This allows unprivileged users, such as subscribers, to perform actions that should be restricted to higher privileged roles, compromising the access control mechanisms of the plugin. [1]
How can this vulnerability impact me? :
This vulnerability can allow low-privileged users to perform unauthorized actions within the Tickera plugin, potentially leading to unauthorized access or modification of event ticketing data or functionality. This compromises the security and integrity of the system, and could lead to misuse or abuse of the ticketing system until the plugin is updated to a fixed version. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for unauthorized access attempts or actions performed by subscriber-level users that should require higher privileges. Since the vulnerability is due to missing authorization checks in the Tickera plugin, you can check plugin version and audit user actions within WordPress logs. Specific commands are not provided in the resources, but you can verify the plugin version via WordPress CLI with: `wp plugin list | grep tickera-event-ticketing-system` to ensure it is not version 3.5.6.2 or earlier. Additionally, monitoring HTTP requests for suspicious access patterns targeting Tickera plugin endpoints may help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Tickera plugin to version 3.5.6.3 or later, which contains the fix for this vulnerability. Until the update can be applied, enabling the Patchstack automatic mitigation rule that blocks attacks targeting this vulnerability is recommended. Additionally, enabling auto-updates for vulnerable plugins via Patchstack can help ensure timely protection. [1]