CVE-2025-58611
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Tickera plugin (tickera-event-ticketing-system) in versions up to and including 3.5.5.6 contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows performing unwanted actions on behalf of a logged-in user.
Risk Assessment
An attacker could trick an administrator or user into performing unintended operations in the ticketing system, potentially leading to configuration or data changes. The risk affects sites with the vulnerable plugin installed.
Recommendation
Update the Tickera plugin to a version later than 3.5.5.6 as soon as available. Until then, consider restricting access to the administrative panel.
Other vulnerabilities in Tickera
See all- CVE-2026-15448Medium
The Tickera – Sell Tickets & Manage Events plugin for WordPress versions up to 3.6.0.1 contain a generic SQL injection vulnerability via the 'tc_order_status_filter' parameter, allowing authenticated users with staff-level access and above to append additional SQL queries, potentially leading to extraction of sensitive data from the database.
- CVE-2026-105889Critical
Blind SQL Injection vulnerability in the Tickera event ticketing system plugin. Improper neutralization of special elements in SQL commands allows an attacker to perform blind SQL injection. Affects versions up to 3.6.0.6.
- CVE-2026-82226Critical
An unauthenticated PHP Object Injection vulnerability was detected in Tickera versions up to 3.6.0.2. This vulnerability may allow an attacker to execute arbitrary code or perform other unauthorized actions.
- CVE-2025-69355Medium
The Tickera plugin (tickera-event-ticketing-system) in versions up to and including 3.5.6.4 contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in Tickera Tickera tickera-event-ticketing-system allows Cross Site Request Forgery.This issue affects Tickera: from n/a through <= 3.5.5.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS