CVE-2025-11517 is an authorization bypass vulnerability in the Event Tickets and Registration WordPress plugin by stellarwp. The issue arises because the API endpoint responsible for processing free ticket orders fails to confirm whether a ticket type should be free. This flaw allows unauthenticated users to exploit the endpoint to acquire paid tickets without paying. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 base score of 7.5, indicating high severity. No patch or official fix information is provided in the available data.

Exploitation of this vulnerability enables unauthenticated attackers to bypass payment requirements and obtain paid tickets without authorization. This results in direct financial loss to the affected organizations due to unauthorized access to paid services. There is no indication of impact on confidentiality or availability, but the integrity of payment enforcement is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting access to the vulnerable endpoint or implementing additional server-side validation to verify ticket payment status. Monitoring for suspicious activity related to ticket orders may also help detect exploitation attempts.