My Tickets WordPress Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the My Tickets – Accessible Event Ticketing plugin for WordPress, affecting all versions through 2.0.16. The issue arises because the mt_save_profile() function fails to properly restrict access, allowing authenticated users with Subscriber-level access and above to unauthorizedly change their roles to administrator.

Impact

Exploitation of this vulnerability allows authenticated users to escalate their privileges to that of an administrator.

Remediation

Users can update to version 2.0.17 or a newer patched version to address this vulnerability.