WordPress CVEs

Description

The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.16. This is due to the mt_save_profile() function not appropriately restricting access to unauthorized users to update roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to that of an administrator.

Affected WordPress components

• My Tickets – Accessible Event Ticketing Plugin · my-tickets
  Confirmed match Active
  Up to and including 2.0.16
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• joedolson My Tickets – Accessible Event Ticketing — Up to and including 2.0.16

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3280248/my-tickets/trunk/my-tickets.php
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/6d875c23-3d8a-4f82-bea3-1c46b5045d94?source=cve
• nvd.nist.gov Official NVD record