CVE-2024-5860 is a vulnerability classified under CWE-862 (Missing Authorization) affecting the Tickera – WordPress Event Ticketing plugin. The issue arises from the absence of a proper capability check on the AJAX action 'tc_dl_delete_tickets', which is responsible for deleting tickets. This flaw allows any authenticated user with at least Subscriber-level privileges to invoke this action and delete all tickets associated with events managed by the plugin. The vulnerability affects all versions up to and including 3.5.2.8. Since the exploit requires only authenticated access and no user interaction, it can be executed remotely by any logged-in user with minimal privileges, bypassing intended access controls. The impact is primarily on data integrity, as ticket data can be maliciously or accidentally deleted, disrupting event management and potentially causing financial and reputational damage. The CVSS 3.1 score of 4.3 reflects a network attack vector, low attack complexity, and low privileges required, with no impact on confidentiality or availability. No patches or exploits are currently documented, but the vulnerability is publicly disclosed and should be addressed promptly.

The primary impact of CVE-2024-5860 is unauthorized deletion of event tickets, which compromises data integrity and disrupts event operations. Organizations using the Tickera plugin for managing event tickets risk losing critical ticketing data, potentially leading to financial loss, customer dissatisfaction, and reputational damage. Since the vulnerability can be exploited by any authenticated user with Subscriber-level access, insider threats or compromised low-privilege accounts pose a significant risk. The disruption may affect ticket sales, event attendance tracking, and refund processes. Although the vulnerability does not directly impact confidentiality or availability, the loss of ticket data can indirectly affect business continuity and trust. The lack of known exploits in the wild reduces immediate risk but does not eliminate the threat, especially for high-profile event organizers or sites with many users.

Organizations should immediately audit user roles and permissions within their WordPress installations to ensure that Subscriber-level users do not have unnecessary access to sensitive plugin actions. Restricting user registrations and enforcing strong authentication can reduce the risk of exploitation. Administrators should monitor for suspicious activity related to ticket deletion and implement logging to detect unauthorized AJAX requests. Since no official patch is currently available, consider applying temporary code-level fixes by adding capability checks to the 'tc_dl_delete_tickets' AJAX handler or disabling the AJAX action if not required. Regular backups of ticket data are essential to enable recovery in case of data loss. Stay informed on vendor updates and apply patches promptly once released. Additionally, consider isolating or limiting plugin usage to trusted users only and employing web application firewalls (WAFs) to detect and block suspicious AJAX calls targeting this vulnerability.