This vulnerability in the Event Tickets Manager for WooCommerce plugin (by WP Swings) is caused by missing authorization checks, which means that certain actions can be performed without proper access control. The affected versions include all versions up to and including 1.5.5. The CVSS 3.1 base score is 6.5, with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. The vendor has not yet provided an official fix or remediation guidance, and no exploits are currently known in the wild.

Successful exploitation could allow an attacker to perform unauthorized actions within the plugin, potentially impacting the integrity and availability of the affected system. There is no confidentiality impact reported. The medium CVSS score reflects the potential for limited but meaningful disruption or manipulation of the plugin's functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations or workarounds have been provided by the vendor at this time.