CVE-2024-5860: 
WordPress vulnerability analysis and mitigation

The Tickera – WordPress Event Ticketing plugin (CVE-2024-5860) contains a vulnerability related to unauthorized loss of data, discovered and disclosed on June 18, 2024. The vulnerability affects all versions up to and including 3.5.2.8 of the plugin. This security issue stems from a missing capability check on the tcdldelete_tickets AJAX action (NVD).

The vulnerability is classified as an Incorrect Authorization issue (CWE-863) and has received a CVSS v3.1 base score of 4.3 (MEDIUM). The technical root cause is attributed to a missing capability check specifically on the tcdldelete_tickets AJAX action, which should restrict access to ticket deletion functionality (NVD).

When exploited, this vulnerability allows authenticated attackers with Subscriber-level access or higher to delete all tickets associated with events in the system. This can lead to significant data loss and disruption of event management operations (NVD).

The vulnerability has been patched in version 3.5.2.9 of the Tickera plugin. Users are advised to update their installations to this version or later to mitigate the risk (NVD).