CVE-2025-1762 Event Tickets with Ticket Scanner < 2.5.4 - Arbitrary Tickets Deletion via CSRF

Q: What is CVE-2025-1762?

CVE-2025-1762 is a medium-severity vulnerability in Unknown Event Tickets with Ticket Scanner, published on 28 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Q: Is CVE-2025-1762 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-1762 exists.

Q: How do I fix CVE-2025-1762?

No fix has been published for CVE-2025-1762 yet. Limit exposure of the affected software until one is available.

Medium 4.3 Published 28 Mar 2025 Updated 28 Mar 2025

Attackers can trick logged-in admins into deleting arbitrary tickets via CSRF, requiring an upgrade to the Event Tickets with Ticket Scanner plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-1762?

CVE-2025-1762 is a medium-severity vulnerability in Unknown Event Tickets with Ticket Scanner, published on 28 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Weakness: CWE-352

Which versions are affected by CVE-2025-1762?

It affects 1 product.

Products include Vollstart Event Tickets With Ticket Scanner.

How do I fix CVE-2025-1762?

No fix has been published for CVE-2025-1762 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-1762 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-1762 exists.

Sources

Also known as GHSA-475h-5v9w-xfp6.