Event Tickets with Ticket Scanner CVE-2024-52427

Exploitation requires (1) the target WordPress site to have the Vollstart Event Tickets with Ticket Scanner plugin installed and activated at version 2.3.11 or earlier; (2) the attacker to possess valid WordPress credentials at a low privilege level (PR:L per CVSS vector - typically Subscriber or Contributor, which are trivial to obtain on sites with open registration); and (3) the underlying web server to have Server-Side Includes processing enabled in the document path where deserialized output is rendered, which is the default in many shared hosting Apache configurations. Limiting factors that reduce realistic risk include sites that have disabled WordPress user registration, sites running on Nginx or other servers without SSI handlers configured for PHP-rendered output, and sites that have restricted the plugin's endpoints via access control. No user interaction is required (UI:N), and the attack is fully network-reachable (AV:N).

Multiple signals point to elevated real-world risk: CVSS 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates network-exploitable, low-complexity attack requiring only low privileges with no user interaction, and notably a scope change (S:C) meaning the impact extends beyond the plugin's security boundary to the underlying WordPress installation. EPSS at 12.22% (94th percentile) is substantially elevated, suggesting active scanning or attacker interest, though it does not confirm exploitation. The vulnerability is not currently listed in CISA KEV, and no public exploit identified at time of analysis. The PR:L requirement (some authentication) tempers the risk somewhat compared to fully unauthenticated RCE bugs, but WordPress sites with open registration, subscriber accounts, or vulnerable credential hygiene effectively neutralize this barrier. The combination of high EPSS percentile, scope change, and the prevalence of low-privilege accounts on WordPress makes this a priority patching target despite the absence of confirmed in-the-wild exploitation.

An attacker registers or compromises a low-privilege WordPress account (e.g., Subscriber or Contributor) on a site running Event Tickets with Ticket Scanner ≤ 2.3.11, then submits a crafted request containing a serialized PHP payload to a plugin endpoint that deserializes user input. The deserialized object causes attacker-controlled content to be rendered through an SSI-processing pipeline, triggering execution of injected SSI directives such as #exec cmd, resulting in arbitrary command execution on the web server with the privileges of the WordPress process. No public exploit identified at time of analysis, but the low attack complexity and detailed CWE/CVSS metadata make weaponization feasible for a motivated researcher.