Tickera CVE-2026-105889

The target must be a WordPress site running the Tickera (tickera-event-ticketing-system) plugin at version 3.6.0.6 or earlier, with the vulnerable ticketing endpoint/parameter reachable. The supplied CVSS vector states PR:N (no authentication) and UI:N (no user interaction), which would mean exploitation against a default installation with no special configuration; however, the exact vulnerable feature/parameter is not named in the description and Patchstack plugin SQLi frequently requires an authenticated role, so the true limiting factor (unauthenticated vs. a required logged-in privilege level) must be confirmed from the Patchstack advisory. Being blind SQLi, exploitation is slower and inference-based but still fully automatable given AC:L.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) scores 9.3 (Critical) and describes a network-reachable, low-complexity, unauthenticated (PR:N) blind SQL injection with a scope change and high confidentiality impact - on paper a top-priority flaw. However, several real-risk tempering signals exist: no EPSS exploitation probability was supplied, the CVE is NOT in CISA KEV (no confirmed active exploitation), and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The single source is Patchstack's WordPress vulnerability database, which commonly classifies plugin SQLi as requiring some authenticated role (e.g., subscriber/author/admin) rather than fully unauthenticated; the PR:N in the vector should be VERIFIED against the Patchstack advisory, because if authentication is actually required the real-world risk is meaningfully lower than the 9.3 suggests. Net: treat as a high-priority patch item for Tickera users due to the confidentiality impact and blind SQLi primitive, but the absence of EPSS/KEV/POC signals points to a patch-now-but-not-yet-exploited posture rather than an emergency, and the PR:N claim is the key unverified variable.

A remote attacker sends crafted input to a vulnerable Tickera endpoint parameter that is concatenated into a SQL query, and uses blind boolean/time-based techniques to infer database contents (e.g., WordPress user records, order/attendee data) one condition at a time. No public exploit code is referenced, but the AC:L/AV:N vector means the injection is straightforward to automate once the vulnerable parameter is identified. If the Patchstack advisory confirms a required logged-in role, the attacker would first need valid credentials at that privilege level.