Privilege Escalation Vulnerability in My Tickets Plugin for WordPress

CVE-2025-3761

What is CVE-2025-3761?

The My Tickets – Accessible Event Ticketing plugin for WordPress contains a vulnerability that allows authenticated attackers with Subscriber-level access and above to escalate their privileges. This occurs due to the mt_save_profile() function failing to restrict access for unauthorized users, permitting them to modify their user roles to that of an administrator. As a result, malicious actors could gain administrative control over the site, compromising its security. All versions up to and including 2.0.16 are affected, necessitating prompt attention to mitigate potential exploitation.

References