CVE-2026-82226

CriticalCVSS 9.8

Published: 31/08/2026(UTC)Translated: 01/09/2026(UTC)NVD NIST

Summary

An unauthenticated PHP Object Injection vulnerability was detected in Tickera versions up to 3.6.0.2. This vulnerability may allow an attacker to execute arbitrary code or perform other unauthorized actions.

Risk Assessment

An unauthenticated attacker can exploit the vulnerability to execute malicious code on the server, potentially leading to full compromise of the application and data.

Recommendation

Update Tickera to the latest patched version. Additionally, restrict access to the application and monitor logs for suspicious activity.

Other vulnerabilities in Tickera

CVE-2026-15448Medium
The Tickera – Sell Tickets & Manage Events plugin for WordPress versions up to 3.6.0.1 contain a generic SQL injection vulnerability via the 'tc_order_status_filter' parameter, allowing authenticated users with staff-level access and above to append additional SQL queries, potentially leading to extraction of sensitive data from the database.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.