Lucene search

WpvulndbWPVDB-ID:F5C58273-4A7C-4D44-BA22-46814DADDAC5

HistoryJun 12, 2024 - 12:00 a.m.

Tickera < 3.5.2.7 - Missing Authorization

2024-06-1200:00:00

wpscan.com

tickera

wordpress

plugin

vulnerability

unauthorized access

data

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.4

Confidence

Low

JSON

Description The Tickera plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_ticket_preview() function in versions up to, and including, 3.5.2.6. This makes it possible for authenticated attackers, with contributor-level access and above, to generate ticket previews.

References

www.wordfence.com/threat-intel/vulnerabilities/id/cf806412-9f21-468e-a497-319d5b24e677

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.4

Confidence

Low

JSON

Related for WPVDB-ID:F5C58273-4A7C-4D44-BA22-46814DADDAC5