The Event Tickets and Registration plugin for WordPress suffers from an improper access control vulnerability (CWE-284) identified as CVE-2024-13457. The vulnerability arises because the plugin does not validate the tc-order-id parameter, which is user-controlled. This lack of validation permits unauthenticated attackers to retrieve sensitive order information belonging to other users. The vulnerability affects all versions up to and including 5.18.1. The CVSS v3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No known exploits in the wild have been reported, and no patch or vendor advisory is currently available.

An unauthenticated attacker can view sensitive order details such as ticket prices, user emails, and order dates for orders they did not place. This exposure compromises user privacy and could facilitate further targeted attacks or phishing. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin or monitoring for unusual access patterns related to order details. Avoid exposing the tc-order-id parameter in untrusted contexts. Follow vendor communications closely for updates.