CVE-2026-82226

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-82226 Write-up: https://abraxaslabs.tech/research/CVE-2026-82226 CVE-2026-82226 Tickera 3.6.0.2 - Tickera I am @abraxasnull. Loopback lab. The client is CVE-2026-82226-Abraxas-Labs.py. Checkout unserializes...

CVE-2026-88998

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without...

CVE-2026-88998

The Tickera WordPress plugin, specifically versions prior to 3.6.0.4 , is vulnerable to an unauthenticated order payment bypass via 2Checkout IPN . The root cause is the plugin's failure to correctly verify the integrity of incoming payment notifications; specifically, the validated signature doe...

WordPress Tickera plugin < 3.6.0.4 - Unauthenticated Order Payment Bypass vulnerability

Unauthenticated Order Payment Bypass vulnerability discovered by ryan fabella in WordPress Plugin Tickera versions 3.6.0.4...

CVE-2026-88998 Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without...

EUVD-2026-100977

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without...

CVE-2026-88998 Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without...

PT-2026-114318

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without...

CVE-2026-88998: Insufficient Verification of Data Authenticity

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without...

CVE-2026-105889

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6...

CVE-2026-105889

The Tickera tickera-event-ticketing-system WordPress plugin (versions ≤ 3.6.0.6 ) is vulnerable to Blind SQL Injection due to the Improper Neutralization of Special Elements used in an SQL Command. This vulnerability allows an attacker to execute arbitrary SQL commands, potentially leading to a h...

EUVD-2026-96381

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6...

CVE-2026-105889 WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6...

CVE-2026-105889 WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6...

CVE-2026-105889: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6...

WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rasyid Abdi Gantoro in WordPress Plugin Tickera versions = 3.6.0.6...

Exploit for CVE-2026-82226

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-82226

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-82226

This CVE affects the Tickera (Event Ticketing System) WordPress plugin, versions 3.6.0.2 and below . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on confidentialit...