What is the CVSS score of CVE-2026-13754?

CVE-2026-13754 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Tickera Plugin CVE-2026-13754

EUVD-2026-44887 MEDIUM

SQL Injection (CWE-89)

2026-07-16 Wordfence

GHSA-6352-h8x4-fmq7

WordPress SQLi Tickera Wordpress Plugin Tickera Sell Tickets Manage Events

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible search input exploitable by any custom-level authenticated user; read-only SQL injection yields high confidentiality loss with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 09:05 vuln.today

CVE Published

Jul 16, 2026 - 07:51 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Tickera - Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 3.6.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL Injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.0) permits authenticated attackers holding a custom-level role or above to append arbitrary SQL to existing queries via the unsanitized 's' search parameter, enabling full database read access. The vulnerability originates in the better-attendees-and-tickets addon (index.php lines 50, 485, and 502) and is confirmed by Wordfence with source code evidence. No active exploitation is confirmed (no CISA KEV listing) and no public exploit has been identified at time of analysis, keeping real-world urgency moderate despite the High confidentiality impact.

Technical ContextAI

The affected product is the Tickera WordPress plugin (CPE: cpe:2.3:a:tickera:tickera_-_sell_tickets_&_manage_events:*:*:*:*:*:*:*:*), a commercial-grade event ticketing solution for WordPress. The root cause is CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command): the 's' parameter - used as a search filter - is interpolated directly into SQL queries without sufficient escaping or parameterized preparation. The vulnerable code is specifically located within the better-attendees-and-tickets addon at index.php lines 50, 485, and 502 in the 3.6.0.0 tag, as referenced by WordPress plugin Trac. Because WordPress itself uses MySQLi or PDO under the hood, the lack of wpdb::prepare() or equivalent sanitization before constructing the query is the proximate failure. This is a classic second-order or inline SQL injection pattern where user-supplied search input is concatenated into a query rather than bound as a prepared statement parameter.

RemediationAI

A patch changeset has been committed to the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3605637%40tickera-event-ticketing-system&new=3605637%40tickera-event-ticketing-system); however, an exact released patched version number is not independently confirmed from the available input data - the fix should be treated as upstream fix available (commit/changeset), released patched version not independently verified. Administrators should update the Tickera plugin to the latest available version from the WordPress plugin directory immediately and verify the fix is included. As a compensating control pending a confirmed patched release, audit and minimize the number of WordPress users assigned the custom-level Tickera role, eliminating any external or low-trust accounts from that role to remove the attack surface. Additionally, deploying a Web Application Firewall (WAF) rule targeting SQL metacharacter injection in the 's' parameter can provide detection and blocking capability, though this may interfere with legitimate search functionality. Consult the Wordfence advisory for the most current patch status.