CVE-2024-35729: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in Tickera WordPress plugin affecting versions through 3.5.2.6. The vulnerability was discovered and reported by Manab Jyoti Dowarah on May 13, 2024, and was publicly disclosed on June 6, 2024. The issue has been assigned CVE-2024-35729 and received a CVSS v3.1 base score of 8.8 (HIGH) from NVD and 5.3 (MEDIUM) from Patchstack (Patchstack Advisory).

The vulnerability is classified as CWE-862 (Missing Authorization) and represents a broken access control issue. The flaw stems from a missing authorization, authentication, or nonce token check in a function that could allow an unprivileged user to execute certain higher privileged actions. The vulnerability received a CVSS v3.1 vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H from NVD, indicating network accessibility, low attack complexity, and high impacts on confidentiality, integrity, and availability (Patchstack Advisory).

The vulnerability has been assessed with a Contributor-level required privilege for exploitation. While specific impact details are limited, broken access control vulnerabilities generally allow attackers to perform unauthorized actions with elevated privileges, potentially compromising the security of the affected WordPress installation (Patchstack Advisory).

The vulnerability requires Contributor-level access for exploitation. Patchstack has classified this as a low-priority issue that is unlikely to be exploited, despite its high CVSS score from NVD (Patchstack Advisory).

The vulnerability has been fixed in version 3.5.2.7 of the Tickera WordPress plugin. Users are advised to update to version 3.5.2.7 or later to remediate this security issue. Patchstack users can enable auto-update functionality for vulnerable plugins (Patchstack Advisory).