EUVD-2026-47905
GHSA-hwp2-f27m-c2g2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible read-only SQLi requiring staff-level authentication; no integrity or availability impact confirmed from description or CVSS.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Tickera - Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.1) enables authenticated attackers with staff-level access to append arbitrary SQL clauses via the unescaped tc_order_status_filter parameter, exposing the full contents of the WordPress database to read access. The flaw originates in the Better Attendees and Tickets addon, with three vulnerable call sites identified in source at lines 238, 252, and 260 of the addon index. No public exploit code and no CISA KEV listing are present at time of analysis, but the straightforward nature of the injection and the staff-level authentication bar make this a realistic internal threat.
Technical ContextAI
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) describes the root cause: the plugin concatenates attacker-controlled input directly into SQL query strings without adequate escaping or use of WordPress's $wpdb->prepare() parameterization API. The vulnerable code resides in the Better Attendees and Tickets addon at includes/addons/better-attendees-and-tickets/index.php (lines 238, 252, and 260 in the 3.6.0.0 source tag). WordPress plugin SQL injection vulnerabilities of this class are a well-understood and frequently exploited category. Because WordPress uses a shared database for all site data, successful exploitation can expose user credentials, email addresses, order data, and other plugin tables beyond the ticketing system itself.
RemediationAI
A code changeset has been committed to the Tickera plugin repository (visible at the WordPress.org Trac changeset reference provided), but the specific released patched version number is not independently confirmed in the available data - update to the latest available version from the WordPress plugin repository and verify the version exceeds 3.6.0.1. Until a patched release is confirmed deployed, restrict the WordPress role of all staff-level accounts to the minimum necessary, auditing who holds 'staff' or higher roles within the Tickera plugin. As a compensating control, deploy a WordPress-aware WAF rule (e.g., Wordfence or similar) to block SQL metacharacter injection attempts against the tc_order_status_filter parameter - note that WAF rules can produce false positives on legitimate filter values. If the Better Attendees and Tickets addon is not in active use, disabling it eliminates the attack surface for this specific flaw.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today