CVE-2025-12356 describes a missing authorization vulnerability in the Tickera – Sell Tickets & Manage Events WordPress plugin affecting all versions up to 3.5.6.4. The issue arises because the AJAX endpoint 'wp_ajax_change_ticket_status' does not perform a capability check, enabling authenticated users with low privileges (Subscriber and above) to update post or event statuses. This could lead to unauthorized modification of event data. The vulnerability has a CVSS 3.1 score of 4.3, reflecting a medium impact primarily on integrity. No patch or remediation details are currently provided, and no exploits are known in the wild.

An attacker with at least Subscriber-level access can modify event or post statuses without proper authorization, potentially leading to unauthorized changes in event management data. The confidentiality and availability are not impacted, but integrity is affected. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for unauthorized changes to event statuses. Avoid granting Subscriber or higher privileges to untrusted users.