Description

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reachable by users holding the plugin's custom Staff role, as the plugin's add_required_capabilities() function grants that role the edit_tc_tickets_instances capability, providing access to the tc_tickets_instances admin list screen where the filter is applied.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-07-23T10:16:51.067Z",
  "pubdate": "2026-07-23T10:16:51.067Z",
  "executiveSummary": "The Tickera – Sell Tickets & Manage Events plugin for WordPress is susceptible to a generic SQL Injection vulnerability affecting all versions up to, and including, 3.6.0.1. The flaw stems from insufficient escaping applied to the 'tc_event_filter' parameter combined with a lack of proper SQL query preparation. This security deficiency allows authenticated threat actors possessing staff-level privileges or higher to manipulate database queries. By appending malicious SQL payloads to the existing query structure, attackers can successfully extract sensitive information directly from the underlying database. Exploitation of this vulnerability requires authentication, specifically leveraging the plugin's custom Staff role which is granted the edit_tc_tickets_instances capability via the add_required_capabilities() function. This capability grants access to the tc_tickets_instances admin list screen where the vulnerable parameter is processed. Organizations utilizing the affected plugin face significant database confidentiality risks if unauthorized staff members or compromised low-privileged accounts leverage this flaw to exfiltrate proprietary data.",
  "technicalDetails": "The vulnerability resides in the handling of the 'tc_event_filter' parameter within the Tickera – Sell Tickets & Manage Events plugin for WordPress, impacting all versions up to, and including, 3.6.0.1. The root cause of the flaw is twofold: insufficient escaping of user-supplied input provided through the 'tc_event_filter' parameter and the absence of parameterized queries or sufficient query preparation within the existing database interaction logic. The vulnerable code path is exposed within the plugin's administrative interface, specifically accessible on the tc_tickets_instances admin list screen. Authorization to reach this administrative component is governed by the plugin's custom Staff role. Through the execution of the add_required_capabilities() function, the plugin explicitly grants the edit_tc_tickets_instances capability to users assigned the Staff role, thereby permitting access to the vulnerable screen and its associated filtering mechanisms. To exploit this vulnerability, an authenticated attacker must hold a role with the requisite edit_tc_tickets_instances capability, such as the plugin's custom Staff role or higher administrative privileges. The attack flow initiates when the user navigates to the targeted admin list screen and injects arbitrary SQL syntax into the 'tc_event_filter' parameter. Because the input is insufficiently escaped and directly concatenated or unsafely integrated into the active SQL query without adequate preparation, the database engine interprets the injected strings as valid SQL commands rather than literal input data. This allows the attacker to append malicious SQL queries to the pre-existing query structure. The behavior of the payload enables the execution of stacked or UNION-based database queries designed to query, manipulate, or extract sensitive information residing in the WordPress database. The post-exploitation impact includes unauthorized data exfiltration, potentially exposing confidential records, user data, or other sensitive information stored within the database tables accessible to the WordPress application context."
}