EUVD-2026-47925
GHSA-78qq-p9v6-3j6p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Staff role is low-privilege authenticated access (PR:L); injection is read-only (C:H, I:N, A:N); network-reachable WordPress admin with no special conditions (AV:N, AC:L).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Tickera - Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reachable by users holding the plugin's custom Staff role, as the plugin's add_required_capabilities() function grants that role the edit_tc_tickets_instances capability, providing access to the tc_tickets_instances admin list screen where the filter is applied.
AnalysisAI
SQL injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.1) allows authenticated attackers holding the plugin's Staff role to append arbitrary SQL to existing queries via the unescaped 'tc_event_filter' parameter, extracting sensitive data from the WordPress database. The exposure is enabled by the plugin's own add_required_capabilities() function, which grants the custom Staff role the edit_tc_tickets_instances capability - meaning any staff-level account can reach the vulnerable tc_tickets_instances admin list screen and trigger the injection. No public exploit or CISA KEV listing has been identified at time of analysis, but the low authentication bar (staff role, not admin) and high confidentiality impact make this a meaningful risk for multi-tenant event-ticketing deployments.
Technical ContextAI
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) describes the root cause: user-supplied input is interpolated directly into an SQL query without adequate escaping or use of parameterized/prepared statements. The vulnerable code resides in the better-attendees-and-tickets addon at includes/addons/better-attendees-and-tickets/index.php (lines 193, 215, 219, 223 of the 3.6.0.0 tag), where the 'tc_event_filter' GET/POST parameter is appended to a database query on the tc_tickets_instances admin list screen. The affected CPE is cpe:2.3:a:tickera:tickera_-_sell_tickets_&_manage_events:*:*:*:*:*:*:*:*, a WordPress plugin that handles event creation and ticket sales. WordPress plugins rely on the $wpdb abstraction layer and its prepare() method for safe queries; the absence of that pattern here is the architectural failure.
RemediationAI
A code change is referenced in the WordPress plugin SVN changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3618129%40tickera-event-ticketing-system&new=3618129%40tickera-event-ticketing-system), indicating an upstream fix was committed; however, no specific patched release version number is confirmed in the available data - administrators should check the Tickera plugin page in the WordPress repository for the latest release and update immediately. As a compensating control pending upgrade, restrict the Staff role to only trusted individuals and audit all accounts holding the edit_tc_tickets_instances capability using a user-role management plugin; reducing the pool of users who can reach the tc_tickets_instances admin screen directly limits exploitation opportunity. Web application firewall rules (e.g., Wordfence's built-in SQLi protection) can block common injection payloads in the tc_event_filter parameter as a defense-in-depth measure, though WAF bypass is possible with obfuscation. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/786ef53a-0fcd-4226-b469-52b72cd6890c should be monitored for confirmed fix version publication.
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events befor
Unauthenticated PHP Object Injection affects the Tickera event ticketing plugin for WordPress in all versions up to and
The Tickera - WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versi
SQL Injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.0) permits auth
Stored Cross-Site Scripting in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.0
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in v
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Conf
The Tickera - WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today