CVE-2025-22717
Published: 21 January 2025
Description
Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects My Tickets: from n/a through <= 2.0.9.
Security Summary
CVE-2025-22717 is a missing authorization vulnerability (CWE-862) in the My Tickets WordPress plugin by Joe Dolson. It enables accessing functionality not properly constrained by access control lists (ACLs). The issue affects all versions of the My Tickets plugin through 2.0.9.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating exploitation over the network with low complexity, no privileges or user interaction required. Unauthenticated remote attackers can leverage it to achieve high confidentiality impact, such as unauthorized access to sensitive data protected by inadequate ACLs.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/my-tickets/vulnerability/wordpress-my-tickets-plugin-2-0-9-broken-access-control-vulnerability?_s_id=cve provides details on this broken access control issue in My Tickets version 2.0.9. Security practitioners should consult it for recommended mitigations, such as updating the plugin if a patch is available.
Details
- CWE(s)