CVE-2026-13754
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to and including 3.6.0.0 due to insufficient escaping and lack of proper query preparation.
Risk Assessment
An authenticated attacker with custom-level access or higher can append additional SQL queries, potentially extracting sensitive information from the database such as passwords or user data.
Recommendation
Immediately update the Tickera plugin to the latest available version that fixes this vulnerability, and restrict administrative access to trusted users only.
Other vulnerabilities in Tickera – Sell Tickets & Manage Events
See all- CVE-2026-15761Medium
The Tickera plugin for WordPress is vulnerable to generic SQL injection via the 'tc_event_filter' parameter in versions up to and including 3.6.0.1. This is due to insufficient escaping and lack of query preparation, allowing authenticated attackers with staff-level access or higher to append additional SQL queries.
- CVE-2026-13755Medium
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'price_wrapper' shortcode attribute in all versions up to and including 3.6.0.0 due to insufficient input sanitization and output escaping.
Original NVD description (English source)
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 3.6.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.