Tickera CVE-2026-88998

Requires a site running the Tickera WordPress plugin before 3.6.0.4 with a payment gateway configured to use the vulnerable notification/callback flow. No authentication, user interaction, or special privileges are needed (AV:N/AC:L/PR:N/UI:N) - the attacker only needs network reach to the site's payment-notification endpoint and knowledge of a target order. The limiting factor is product scope (only Tickera-based ticketing stores are affected) and version (patched in 3.6.0.4); it does not impact WordPress generally.

This is a payment-verification bypass in the Tickera WordPress ticketing plugin: incoming payment notifications are not integrity-checked and the validated signature does not cover the order ID or amount, so an unauthenticated attacker can forge a 'paid' confirmation. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) correctly reflects a remote, unauthenticated, low-complexity attack with no confidentiality or availability impact, but the I:L rating likely understates the business impact - the flaw enables direct financial fraud (obtaining tickets/goods without paying), which is closer to a high integrity impact; see assessed vector below. Public exploit code exists (WPScan), raising practical risk, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation at this time. Net: a genuine, easily-reproducible fraud/integrity issue worth prioritizing for any site running affected Tickera versions, though the real-world blast radius is bounded by the plugin's moderate deployment footprint rather than being an internet-wide emergency. No conflicting signals in the core data; the main caveat is that EPSS and precise install-base figures are missing.

An attacker places (or targets) an order in a Tickera-powered store, then sends a forged payment-notification callback to the plugin's payment handler. Because the signature validation does not bind to the order or amount, the plugin accepts the forged notification and marks the order as paid, issuing valid tickets without any payment being made. Public exploit code is available via WPScan, lowering the skill required to reproduce this unauthenticated against affected sites.