Unauthorized Data Deletion in Event Tickets and Registration Plugin for WordPress

CVE-2025-1402

What is CVE-2025-1402?

The Event Tickets and Registration plugin for WordPress contains a vulnerability that allows authenticated users, including those with Contributor-level access, to delete arbitrary tickets. This issue arises from a missing capability check in the 'ajax_ticket_delete' function, affecting all versions up to and including 5.19.1.1. Attackers can exploit this flaw to conduct unauthorized deletions of attendee tickets, compromising event management integrity and user data security.

References