Privilege Escalation Vulnerability in My Tickets Plugin for WordPress

CVE-2025-3761

What is CVE-2025-3761?

The My Tickets – Accessible Event Ticketing plugin for WordPress contains a vulnerability that allows authenticated attackers with Subscriber-level access and above to escalate their privileges. This occurs due to the mt_save_profile() function failing to restrict access for unauthorized users, permitting them to modify their user roles to that of an administrator. As a result, malicious actors could gain administrative control over the site, compromising its security. All versions up to and including 2.0.16 are affected, necessitating prompt attention to mitigate potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References