Tickera vulnerabilities

The Tickera – Sell Tickets & Manage Events plugin for WordPress versions up to 3.6.0.1 contain a generic SQL injection vulnerability via the 'tc_order_status_filter' parameter, allowing authenticated users with staff-level access and above to append additional SQL queries, potentially leading to extraction of sensitive data from the database.

Blind SQL Injection vulnerability in the Tickera event ticketing system plugin. Improper neutralization of special elements in SQL commands allows an attacker to perform blind SQL injection. Affects versions up to 3.6.0.6.

An unauthenticated PHP Object Injection vulnerability was detected in Tickera versions up to 3.6.0.2. This vulnerability may allow an attacker to execute arbitrary code or perform other unauthorized actions.