CVE-2026-15761
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The Tickera plugin for WordPress is vulnerable to generic SQL injection via the 'tc_event_filter' parameter in versions up to and including 3.6.0.1. This is due to insufficient escaping and lack of query preparation, allowing authenticated attackers with staff-level access or higher to append additional SQL queries.
Risk Assessment
An attacker can extract sensitive information from the database, such as user data or passwords, potentially leading to a breach of data confidentiality.
Recommendation
It is recommended to immediately update the Tickera plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Tickera – Sell Tickets & Manage Events
See all- CVE-2026-13755Medium
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'price_wrapper' shortcode attribute in all versions up to and including 3.6.0.0 due to insufficient input sanitization and output escaping.
- CVE-2026-13754Medium
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to and including 3.6.0.0 due to insufficient escaping and lack of proper query preparation.
Original NVD description (English source)
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reachable by users holding the plugin's custom Staff role, as the plugin's add_required_capabilities() function grants that role the edit_tc_tickets_instances capability, providing access to the tc_tickets_instances admin list screen where the filter is applied.