CVE-2025-69355: 
WordPress vulnerability analysis and mitigation

CVE-2025-69355 is a Missing Authorization (Broken Access Control) vulnerability in the Tickera WordPress plugin (tickera-event-ticketing-system) that allows authenticated users with low privileges (Subscriber level) to perform actions beyond their intended access level. It affects all versions of the Tickera plugin up to and including 3.5.6.4. The vulnerability was reported by Nabil Irawan on December 10, 2025, and published by Patchstack on January 6–9, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain privileged functions. Specifically, the vulnerability involves a missing authorization, authentication, or nonce token check in a plugin function, allowing a low-privileged authenticated user (e.g., a Subscriber) to invoke higher-privileged actions. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity (Patchstack). No public proof-of-concept exploit code has been identified at this time.

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions within the Tickera plugin, resulting in a limited integrity impact (e.g., modifying event ticketing data or plugin settings). There is no confidentiality or availability impact per the CVSS scoring. The scope is limited to the affected WordPress installation, with no evidence of lateral movement potential beyond the plugin's functionality (Patchstack).

No active in-the-wild exploitation has been reported for CVE-2025-69355, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with no impactful threat, though they note that broken access control vulnerabilities of this type can be used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

The vulnerability is patched in Tickera plugin version 3.5.6.5. Site administrators should update the Tickera plugin to version 3.5.6.5 or later immediately via the WordPress admin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting user registration or limiting Subscriber-level accounts on the WordPress site can reduce exposure (Patchstack).

The vulnerability was discovered and disclosed by security researcher Nabil Irawan through Patchstack's responsible disclosure program. Patchstack assessed the issue as low priority with unlikely exploitation impact. No significant broader media coverage or notable community discussion has been identified beyond standard vulnerability database aggregation (Patchstack).