CVE-2025-3761 is a privilege escalation vulnerability in the My Tickets – Accessible Event Ticketing WordPress plugin (up to version 2.0.16). The issue stems from improper privilege management (CWE-269) in the mt_save_profile() function, which fails to restrict unauthorized role updates. Authenticated users with Subscriber-level privileges or higher can exploit this to elevate their role to administrator, gaining full administrative control over the WordPress site. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. No patch or official fix has been documented in the provided data.

Successful exploitation allows an authenticated low-privilege user to escalate their privileges to administrator, potentially leading to full site compromise including data theft, site defacement, or further malicious activity. The vulnerability affects all versions up to and including 2.0.16 of the plugin. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. Monitor for updates from the vendor or WordPress plugin repository for a security patch addressing this issue.