The Tickera WordPress Event Ticketing plugin contains an information exposure vulnerability (CWE-200) in the 'tickera_tickets_info' endpoint. This flaw permits unauthenticated attackers to retrieve sensitive booking data including personal identifiers and timestamps. The vulnerability affects all versions up to and including 3.5.4.8. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low complexity, no privileges required, and no user interaction needed, with confidentiality impact only.

An attacker can obtain sensitive personal information from event bookings without authentication, potentially leading to privacy violations and unauthorized data disclosure. There is no impact on data integrity or system availability. The exposure of personal data such as full names and email addresses could facilitate further targeted attacks or social engineering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the 'tickera_tickets_info' endpoint through web application firewall rules or other access controls to prevent unauthenticated access to sensitive booking data.