PT-2025-17703 · WordPress · My Tickets

Ngocanh Le · Published 2025-04-24 · Updated 2025-04-29 · CVE-2025-3761

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions My Tickets – Accessible Event Ticketing plugin for WordPress versions up to and including 2.0.16

Description The issue arises from the mt save profile() function not properly restricting access to unauthorized users to update roles. This allows authenticated attackers with Subscriber-level access or higher to update their role to that of an administrator.

Recommendations For versions up to and including 2.0.16, update to a version higher than 2.0.16 to resolve the issue. As a temporary workaround, consider restricting access to the mt save profile() function to prevent unauthorized role updates until a patch is available.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-3761

Affected Products

My Tickets

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-3761 · Security Note
• https://twitter.com/cybercronai/status/1915526605109145941 · Twitter Post
• https://twitter.com/CveFindCom/status/1915307945996308876 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6d875c23-3d8a-4f82-bea3-1c46b5045d94?source=cve · Note
• https://twitter.com/WolfgangSesin/status/1915389083003605079 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3280248/my-tickets/trunk/my-tickets.php · Note
• https://twitter.com/vulns_space/status/1915314089745617115 · Twitter Post
• https://twitter.com/CVEnew/status/1915303682649792564 · Twitter Post
• https://t.me/cvetracker/22260 · Telegram Post
• https://twitter.com/cracbot/status/1917172071957774464 · Twitter Post
• https://t.me/cvedetector/23648 · Telegram Post