CVE-2026-82226

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-82226 CVE-2026-82226 Tickera 3.6.0.2 - Tickera I am @abraxasnull. Loopback lab. The client is CVE-2026-82226-Abraxas-Labs.py. Checkout unserializes the attendee. Unauthenticated cart - process-payment...

Exploit for CVE-2026-82226

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-82226

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-82226

This CVE affects the Tickera (Event Ticketing System) WordPress plugin, versions 3.6.0.2 and below . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on confidentialit...

CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

EUVD-2026-68796

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-82226: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ionut Pipirig in WordPress Plugin Tickera versions = 3.6.0.2...

PT-2026-84027

Name of the Vulnerable Software and Affected Versions Tickera versions prior to 3.6.0.3 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objects a...

CVE-2026-15761

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tceventfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15448

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tcorderstatusfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2026-15448 Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tcorderstatusfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2026-15448 Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tcorderstatusfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

EUVD-2026-47905

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tcorderstatusfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2026-15448

Tickera – Sell Tickets & Manage Events (WordPress) is vulnerable to a generic SQL Injection via the tc_order_status_filter parameter in all versions up to 3.6.0.1, caused by insufficient escaping of user input and inadequate preparation of the existing SQL query. Authenticated attackers with staf...

CVE-2026-15448

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tcorderstatusfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2026-15761

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tceventfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15761 Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tceventfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15761

The Tickera WordPress plugin (versions up to 3.6.0.1) is affected by a generic SQL Injection via the tc_event_filter parameter due to insufficient escaping and improper query preparation. The vulnerability is exploitable by authenticated staff+, who gain access via the edit_tc_tickets_instances c...