CVE-2024-12578: Tickera WordPress Plugin Information Disclosure

CVE-2024-12578 Overview

CVE-2024-12578 is an information exposure vulnerability in the Tickera – WordPress Event Ticketing plugin. The flaw affects all versions up to and including 3.5.4.8. The vulnerable tickera_tickets_info endpoint allows unauthenticated attackers to extract sensitive booking data over the network. Exposed data includes attendee full names, email addresses, and check-in/check-out timestamps. The issue is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can harvest personally identifiable information (PII) from event bookings without any user interaction or privileges.

Affected Products

Tickera – WordPress Event Ticketing plugin versions ≤ 3.5.4.8
WordPress sites running vulnerable Tickera installations
Event registration data managed through the plugin

Discovery Timeline

2024-12-14 - CVE-2024-12578 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12578

Vulnerability Analysis

The Tickera plugin exposes a REST-style endpoint named tickera_tickets_info that returns booking records. The endpoint lacks proper authentication and authorization checks. Any unauthenticated client can query the endpoint and receive attendee data in the response.

Exposed fields include full names, email addresses, and event check-in/check-out timestamps. This data is sufficient for targeted phishing and social engineering campaigns against event attendees. Attackers can also enumerate booking records to build customer lists from affected sites.

Root Cause

The root cause is missing access control on the tickera_tickets_info endpoint. The plugin does not verify the caller's capability or session before returning booking records. This design permits direct object access without authorization (CWE-200).

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker sends a crafted HTTP request to the tickera_tickets_info endpoint. The server responds with structured booking data. No authentication, user interaction, or elevated privileges are required. Refer to the Wordfence Vulnerability Report for technical detail on the affected endpoint.

Detection Methods for CVE-2024-12578

Indicators of Compromise

Unauthenticated HTTP requests targeting the tickera_tickets_info endpoint in web server logs
High-volume enumeration requests from single source IPs against Tickera endpoints
Outbound data transfer spikes correlated with admin-ajax.php or Tickera REST routes
Anomalous scraping patterns against /wp-admin/admin-ajax.php?action=tickera_tickets_info

Detection Strategies

Monitor WordPress access logs for requests to tickera_tickets_info originating from unauthenticated sessions
Deploy web application firewall (WAF) rules that flag repeated calls to the vulnerable endpoint
Correlate response sizes on Tickera endpoints to identify bulk data extraction attempts

Monitoring Recommendations

Enable verbose logging on WordPress plugins that expose AJAX or REST endpoints
Alert on any unauthenticated GET or POST request to tickera_tickets_info
Track user-agent strings and geographic origin for repeated endpoint access
Review CDN and reverse proxy logs for endpoint scraping patterns

How to Mitigate CVE-2024-12578

Immediate Actions Required

Update the Tickera – WordPress Event Ticketing plugin to a version above 3.5.4.8 as soon as a patched release is available
Audit web server logs for prior unauthenticated access to the tickera_tickets_info endpoint
Notify affected attendees if log review indicates data exfiltration occurred

Patch Information

A fix is referenced in the WordPress plugin changeset for the tickera-event-ticketing-system repository. Site administrators should apply the plugin update through the WordPress dashboard or via WP-CLI.

Workarounds

Block unauthenticated requests to the tickera_tickets_info endpoint at the WAF or reverse proxy layer
Restrict access to /wp-admin/admin-ajax.php actions related to Tickera using IP allowlists where feasible
Temporarily deactivate the Tickera plugin on sites that cannot be patched immediately

bash

# Example nginx rule to block unauthenticated access to the vulnerable endpoint
location ~* /wp-admin/admin-ajax.php {
    if ($arg_action = "tickera_tickets_info") {
        return 403;
    }
}