The vulnerability CVE-2025-68015 affects Vollstart's Event Tickets with Ticket Scanner plugin (<= 2.8.5) and is characterized by improper control over code generation, resulting in a code injection vulnerability. The CVSS 3.1 base score is 9.0, indicating critical severity with network attack vector, high attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The plugin is not a cloud service, and no patch or vendor advisory details are available to confirm remediation status.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on affected systems without authentication, leading to full compromise of the impacted environment. The CVSS score reflects critical impact on confidentiality, integrity, and availability. There are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin and monitoring for suspicious activity related to code injection attempts. Do not assume the vulnerability is mitigated without vendor confirmation.