CVE-2025-69355
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Tickera plugin (tickera-event-ticketing-system) in versions up to and including 3.5.6.4 contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker may perform actions they should not be authorized to do, potentially leading to unauthorized access or data modification. This affects WordPress installations with the vulnerable plugin version.
Recommendation
Update the Tickera plugin to a version newer than 3.5.6.4. Check whether any unauthorized configuration changes have occurred.
Other vulnerabilities in Tickera
See all- CVE-2026-15448Medium
The Tickera – Sell Tickets & Manage Events plugin for WordPress versions up to 3.6.0.1 contain a generic SQL injection vulnerability via the 'tc_order_status_filter' parameter, allowing authenticated users with staff-level access and above to append additional SQL queries, potentially leading to extraction of sensitive data from the database.
- CVE-2026-105889Critical
Blind SQL Injection vulnerability in the Tickera event ticketing system plugin. Improper neutralization of special elements in SQL commands allows an attacker to perform blind SQL injection. Affects versions up to 3.6.0.6.
- CVE-2026-82226Critical
An unauthenticated PHP Object Injection vulnerability was detected in Tickera versions up to 3.6.0.2. This vulnerability may allow an attacker to execute arbitrary code or perform other unauthorized actions.
Original NVD description (English source)
Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.6.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS