The Nexcess Event Tickets plugin is affected by a critical access control vulnerability that permits unauthenticated attackers to manipulate application data.

This is a CWE-862 Missing Authorization flaw. The plugin fails to perform necessary capability checks, allowing unauthenticated remote attackers to invoke restricted functions.

The lack of authorization controls presents a high risk to business operations, as it allows unauthorized actors to potentially manipulate event data or impact system integrity. With a CVSS score of 7.5, this high-severity vulnerability poses a significant threat to data integrity, potentially leading to unauthorized administrative actions that could disrupt business processes or compromise event management workflows.

Immediate Action: Update the Nexcess Event Tickets plugin to the latest available version beyond 5.28.5. If an update is not immediately available, disable the plugin to prevent exploitation.

Proactive Monitoring: Review web server access logs for anomalous requests targeting plugin-specific endpoints or unauthorized attempts to access administrative functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious traffic patterns and unauthorized requests directed at the plugin's directory.

Public Exploit Available: No

This vulnerability represents a significant security oversight that requires immediate attention. Organizations utilizing the Event Tickets plugin must prioritize updating to the latest secure version to mitigate the risk of unauthorized access and maintain the integrity of their event management platform.