CVE-2025-1402: Event Tickets Auth Bypass Vulnerability

CVE-2025-1402 Overview

CVE-2025-1402 affects the Event Tickets and Registration plugin for WordPress in all versions up to and including 5.19.1.1. The plugin fails to enforce a capability check on the ajax_ticket_delete function. Authenticated users with Contributor-level access or higher can delete arbitrary Attendee tickets on affected sites.

The flaw is classified as [CWE-862] Missing Authorization. It is exploitable over the network with low attack complexity and requires only low-privilege authentication. The vulnerability impacts data integrity but does not expose confidential data or affect availability directly.

Critical Impact
Contributor-level accounts can delete arbitrary event ticket records, disrupting event operations and destroying attendee registration data.

Affected Products

Event Tickets and Registration plugin for WordPress, all versions up to and including 5.19.1.1
Deployments where untrusted users hold Contributor role or higher
WordPress sites using the plugin from The Events Calendar vendor (theeventscalendar)

Discovery Timeline

2025-02-21 - CVE-2025-1402 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1402

Vulnerability Analysis

The Event Tickets and Registration plugin exposes an AJAX endpoint handled by the ajax_ticket_delete function. This function processes requests to delete Attendee ticket records but omits a current_user_can() capability check. WordPress authenticates the request through the standard nonce and session mechanisms, but no authorization gate restricts the operation to administrators or event organizers.

As a result, any authenticated user session with at least Contributor privileges can invoke the endpoint. The function processes the ticket identifier supplied in the request and removes the corresponding Attendee record from the database. This destroys registration data associated with events managed through the plugin.

The impact is limited to integrity. Confidential data is not disclosed, and the site remains operational, but attendee ticket data can be deleted arbitrarily. Contributor is a common role on multi-author WordPress sites, which broadens the pool of accounts that can trigger the flaw.

Root Cause

The ajax_ticket_delete handler registered in the plugin's Metabox class performs the delete action without verifying that the caller has the capability to manage the target ticket or event. Reference points in the vulnerable code paths include src/Tribe/Metabox.php and asset registration in src/Tribe/Assets.php. See the WordPress Metabox Code Reference for the affected function.

Attack Vector

An attacker authenticates to the WordPress site using any Contributor-or-above account. The attacker then sends an AJAX POST request to the admin-ajax.php endpoint targeting the vulnerable action with a valid nonce and the ticket identifier of a target Attendee. The server processes the deletion without checking authorization, and the ticket is removed. The action can be repeated across ticket IDs to delete records in bulk.

No verified proof-of-concept code has been published. Refer to the Wordfence Vulnerability Report for advisory details.

Detection Methods for CVE-2025-1402

Indicators of Compromise

Unexpected deletions of Attendee ticket records tied to Contributor or Author accounts
AJAX requests to admin-ajax.php with the ticket-delete action originating from low-privilege user sessions
Sudden drops in attendee counts for events that were not manually modified by administrators

Detection Strategies

Audit WordPress database logs for DELETE statements affecting Event Tickets Attendee tables outside administrator sessions
Review web server access logs for POST requests to admin-ajax.php with the vulnerable action name from non-admin users
Enable WordPress activity logging plugins to record ticket deletion events with actor role attribution

Monitoring Recommendations

Alert on Attendee ticket deletion volume spikes and correlate with the acting user role
Monitor Contributor and Author account activity for AJAX calls to plugin endpoints they do not require
Track plugin version inventory across WordPress instances to identify hosts still running 5.19.1.1 or earlier

How to Mitigate CVE-2025-1402

Immediate Actions Required

Update the Event Tickets and Registration plugin to a version later than 5.19.1.1 on all WordPress instances
Audit user roles and revoke Contributor or higher access from accounts that do not require it
Review Attendee ticket records for unexpected deletions and restore from backup where necessary

Patch Information

The vendor released a patched version of the Event Tickets and Registration plugin that adds the missing capability check to ajax_ticket_delete. Administrators should install the fixed release through the WordPress plugin dashboard or by manual upload. Consult the Wordfence Vulnerability Report for the specific fixed version.

Workarounds

Temporarily restrict Contributor role assignments until the plugin is updated
Deploy a web application firewall rule blocking the vulnerable AJAX action for non-administrator sessions
Maintain frequent backups of the WordPress database so Attendee data can be restored after unauthorized deletions

bash

# Verify installed Event Tickets plugin version via WP-CLI
wp plugin get event-tickets --field=version

# Update the plugin to the latest patched release
wp plugin update event-tickets