CVE-2024-5860: Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tcdldeletetickets AJAX action in all versions up to, and including, 3.5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all tickets associated with events.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tickera – WordPress Event Ticketing plugin for WordPressto a version that resolves this vulnerability.Fixed in 3.5.2.8 - Configuration
Update the plugin so the tc_dl_delete_tickets AJAX action includes proper authorization (capability) checks; the issue affects all versions up to and including 3.5.2.8, where the capability check is missing.
Tickera – WordPress Event Ticketing plugin for WordPress (tc_dl_delete_tickets AJAX action) capability/authorization check = Add required capability check to ensure only authorized users can delete tickets
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5860?
CVE-2024-5860 has a medium severity rating due to its potential for unauthorized data loss.
How can I fix CVE-2024-5860?
To fix CVE-2024-5860, update the Tickera plugin to version 3.5.2.9 or later.
Who is affected by CVE-2024-5860?
CVE-2024-5860 affects all versions of the Tickera plugin up to and including 3.5.2.8.
What kind of vulnerability is CVE-2024-5860?
CVE-2024-5860 is a security vulnerability that allows authenticated attackers to delete tickets without proper permissions.
Is there a workaround for CVE-2024-5860?
Currently, the recommended mitigation for CVE-2024-5860 is to update the plugin, as there are no alternative workarounds available.