CVE-2026-15448
MediumCVSS 6.5Summary
The Tickera – Sell Tickets & Manage Events plugin for WordPress versions up to 3.6.0.1 contain a generic SQL injection vulnerability via the 'tc_order_status_filter' parameter, allowing authenticated users with staff-level access and above to append additional SQL queries, potentially leading to extraction of sensitive data from the database.
Risk Assessment
The risk involves extraction of sensitive data from the database, such as user data, orders, or passwords, by attackers with limited access.
Recommendation
Update the Tickera plugin to a version above 3.6.0.1 that fixes this vulnerability.
Other vulnerabilities in Tickera
See all- CVE-2026-105889Critical
Blind SQL Injection vulnerability in the Tickera event ticketing system plugin. Improper neutralization of special elements in SQL commands allows an attacker to perform blind SQL injection. Affects versions up to 3.6.0.6.
- CVE-2026-82226Critical
An unauthenticated PHP Object Injection vulnerability was detected in Tickera versions up to 3.6.0.2. This vulnerability may allow an attacker to execute arbitrary code or perform other unauthorized actions.
- CVE-2025-69355Medium
The Tickera plugin (tickera-event-ticketing-system) in versions up to and including 3.5.6.4 contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS