CVE-2026-105889
CriticalCVSS 9.3Summary
Blind SQL Injection vulnerability in the Tickera event ticketing system plugin. Improper neutralization of special elements in SQL commands allows an attacker to perform blind SQL injection. Affects versions up to 3.6.0.6.
Risk Assessment
An attacker could gain unauthorized access to database data, including customer and transaction data, potentially leading to confidentiality and integrity breaches.
Recommendation
Update the Tickera plugin to the latest patched version. If not available, restrict access to the admin panel and apply additional security measures such as a web application firewall.
Other vulnerabilities in Tickera
See all- CVE-2026-15448Medium
The Tickera – Sell Tickets & Manage Events plugin for WordPress versions up to 3.6.0.1 contain a generic SQL injection vulnerability via the 'tc_order_status_filter' parameter, allowing authenticated users with staff-level access and above to append additional SQL queries, potentially leading to extraction of sensitive data from the database.
- CVE-2026-82226Critical
An unauthenticated PHP Object Injection vulnerability was detected in Tickera versions up to 3.6.0.2. This vulnerability may allow an attacker to execute arbitrary code or perform other unauthorized actions.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS