CVE-2024-10263 affects the Tickera – Sell Tickets & Manage Events WordPress plugin, allowing unauthenticated attackers to execute arbitrary shortcodes via improper validation before the do_shortcode function is called. This code injection vulnerability exists in all versions up to and including 3.5.4.4. The vulnerability enables remote code execution through shortcode injection without requiring authentication or user interaction, impacting confidentiality, integrity, and availability of the affected system. The CVSS score of 7.3 reflects the high risk posed by this flaw. No patch or official fix details are currently available.

An attacker can remotely execute arbitrary shortcodes on vulnerable installations of the Tickera plugin without authentication, potentially leading to unauthorized code execution. This can compromise confidentiality, integrity, and availability of the WordPress site and its data. The vulnerability is exploitable over the network with low attack complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and consider disabling it if possible. Monitor official Tickera channels for updates and apply patches promptly once available.