Description

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-07-23T10:16:50.687Z",
  "pubdate": "2026-07-23T10:16:50.687Z",
  "executiveSummary": "The Tickera – Sell Tickets & Manage Events plugin for WordPress is susceptible to a generic SQL Injection vulnerability impacting all versions up to and including 3.6.0.1. This security flaw stems from inadequate input sanitization and a lack of proper query parameterization concerning user-supplied data inputs. The vulnerability exposes the underlying database to manipulation by authenticated threat actors.\nSuccessful exploitation of this flaw allows attackers with staff-level access and above to inject arbitrary SQL commands into pre-existing database queries. The primary impact of this vulnerability is the unauthorized extraction of sensitive information residing within the WordPress database. Given the necessary privilege requirements, this issue represents a significant risk regarding data confidentiality and privilege abuse within the targeted WordPress environment.",
  "technicalDetails": "The vulnerability resides in the handling of the 'tc_order_status_filter' parameter processed by the Tickera – Sell Tickets & Manage Events plugin. The root cause of the flaw is twofold: insufficient escaping of user-supplied data entering the parameter and a fundamental lack of query preparation mechanisms within the existing database interaction logic.\nThe vulnerable component processes the 'tc_order_status_filter' parameter without employing proper input sanitization or parameterized queries, which allows malicious SQL syntax to be interpreted directly by the database management system. Because the input is concatenated or interpolated directly into the active SQL statement without adequate neutralization of special characters, the execution context of the query is altered.\nThe attack flow begins with an authenticated user possessing staff-level access or higher crafting a malicious HTTP request containing a payload appended to the 'tc_order_status_filter' parameter. Upon submission, the vulnerable application accepts the unsanitized input and incorporates it directly into the database query execution pipeline. The database engine parses the resulting string, executing the original query alongside the attacker's injected SQL commands.\nThis behavior enables the execution of stacked or union-based SQL queries depending on the database architecture and query structure. Post-exploitation impact heavily centers on data exfiltration, allowing the attacker to query sensitive tables within the WordPress database, such as user credentials, personally identifiable information, or ticketing transaction records, thereby compromising the confidentiality of the system."
}