CVE-2026-82226
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
An unauthenticated PHP Object Injection vulnerability was detected in Tickera versions up to 3.6.0.2. This vulnerability may allow an attacker to execute arbitrary code or perform other unauthorized actions.
Risk Assessment
An unauthenticated attacker can exploit the vulnerability to execute malicious code on the server, potentially leading to full compromise of the application and data.
Recommendation
Update Tickera to the latest patched version. Additionally, restrict access to the application and monitor logs for suspicious activity.
Other vulnerabilities in Tickera
See all- CVE-2026-15448Medium
The Tickera – Sell Tickets & Manage Events plugin for WordPress versions up to 3.6.0.1 contain a generic SQL injection vulnerability via the 'tc_order_status_filter' parameter, allowing authenticated users with staff-level access and above to append additional SQL queries, potentially leading to extraction of sensitive data from the database.
- CVE-2026-105889Critical
Blind SQL Injection vulnerability in the Tickera event ticketing system plugin. Improper neutralization of special elements in SQL commands allows an attacker to perform blind SQL injection. Affects versions up to 3.6.0.6.
- CVE-2025-69355Medium
The Tickera plugin (tickera-event-ticketing-system) in versions up to and including 3.5.6.4 contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS