CVE-2025-22717
Published: 21 January 2025
Summary
CVE-2025-22717 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-22717 is a missing authorization vulnerability (CWE-862) in the My Tickets WordPress plugin by Joe Dolson. It enables accessing functionality not properly constrained by access control lists (ACLs). The issue affects all versions of the My Tickets plugin through 2.0.9.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating exploitation over the network with low complexity, no privileges or user interaction required. Unauthenticated remote attackers can leverage it to achieve high confidentiality impact, such as unauthorized access to sensitive data protected by inadequate ACLs.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/my-tickets/vulnerability/wordpress-my-tickets-plugin-2-0-9-broken-access-control-vulnerability?_s_id=cve provides details on this broken access control issue in My Tickets version 2.0.9. Security practitioners should consult it for recommended mitigations, such as updating the plugin if a patch is available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2938
Vulnerability details
Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects My Tickets: from n/a through <= 2.0.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The missing authorization (broken access control) vulnerability in the public-facing My Tickets WordPress plugin directly enables remote unauthenticated exploitation of a public-facing web application to access sensitive data.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for access to information and system resources, countering the missing authorization checks in the My Tickets plugin.
Identifies, reports, and corrects flaws like this broken access control vulnerability through timely patching of the affected plugin versions.
Applies least privilege to restrict access to only necessary functions, mitigating the impact of unauthorized functionality access due to inadequate ACLs.