CVE-2026-13754 Overview
CVE-2026-13754 is a SQL injection vulnerability in the Tickera – Sell Tickets & Manage Events plugin for WordPress. The flaw affects all versions up to and including 3.6.0.0. The vulnerability exists in the handling of the s parameter, where user-supplied input is neither escaped properly nor incorporated into a prepared statement. Authenticated attackers with custom-level access or higher can append additional SQL clauses to existing queries. Successful exploitation allows extraction of sensitive information from the WordPress database, including user credentials and site configuration data. The issue is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
Authenticated users with custom-level access can extract arbitrary data from the WordPress database, including hashed credentials and session tokens.
Affected Products
- Tickera – Sell Tickets & Manage Events plugin for WordPress
- All versions up to and including 3.6.0.0
- WordPress sites running the better-attendees-and-tickets add-on component
Discovery Timeline
- 2026-07-16 - CVE-2026-13754 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-13754
Vulnerability Analysis
The vulnerability resides in the better-attendees-and-tickets add-on shipped with the Tickera plugin. The plugin accepts an s search parameter from authenticated users and concatenates the value directly into a SQL query executed against the WordPress database. Because the plugin neither sanitizes the input with esc_sql() nor uses $wpdb->prepare() with proper placeholders, an attacker controls a fragment of the final SQL statement. This constitutes a generic SQL injection primitive, allowing UNION-based, boolean-based, or time-based extraction techniques depending on the query context. The impact metrics reflect high confidentiality loss with no direct integrity or availability impact.
Root Cause
The root cause is insufficient input escaping combined with the absence of parameterized queries. The affected code paths — visible at lines 50, 485, and 502 of includes/addons/better-attendees-and-tickets/index.php — build SQL statements through string concatenation using the raw s request parameter. WordPress provides $wpdb->prepare() specifically to prevent this class of flaw, but the developers did not apply it to the search functionality.
Attack Vector
Exploitation requires an authenticated session with custom-level access or above. The attacker submits a crafted s parameter through the plugin's search interface. The injected payload closes the original query context and appends additional clauses such as UNION SELECT statements to enumerate the wp_users table. Because the attack traverses the network with low complexity and no user interaction, any account meeting the privilege threshold can execute it against a vulnerable site.
No verified exploit code is publicly available. Refer to the Wordfence Vulnerability Analysis and the WordPress Tickera Changeset for the vendor's remediation diff.
Detection Methods for CVE-2026-13754
Indicators of Compromise
- HTTP requests containing SQL syntax such as UNION, SELECT, SLEEP(, or comment sequences (--, /*) in the s query parameter targeting Tickera endpoints.
- Unusually long or URL-encoded values in the s parameter submitted by low-privilege authenticated accounts.
- Database query logs showing errors or unexpected UNION operations originating from the better-attendees-and-tickets add-on.
- Outbound data staging by authenticated custom-level accounts that historically performed only routine actions.
Detection Strategies
- Enable WordPress query logging and alert on queries generated by the Tickera plugin that contain multiple statements or information_schema references.
- Deploy a Web Application Firewall (WAF) rule set that inspects the s parameter for SQL metacharacters on Tickera routes.
- Correlate authentication events for custom-level accounts with subsequent search requests to identify anomalous account behavior.
Monitoring Recommendations
- Monitor the wp_users and wp_usermeta tables for read patterns originating outside normal administrative workflows.
- Track HTTP 500 responses tied to Tickera URLs, which often indicate failed injection attempts and reconnaissance.
- Aggregate access logs into a centralized data lake to retain evidence for post-incident forensic review.
How to Mitigate CVE-2026-13754
Immediate Actions Required
- Upgrade the Tickera – Sell Tickets & Manage Events plugin to a version later than 3.6.0.0 as soon as the vendor publishes a fixed release.
- Audit all WordPress user accounts with custom-level or higher privileges and disable those that are inactive or unrecognized.
- Rotate WordPress administrator passwords, secret keys in wp-config.php, and any API tokens that may have been exposed.
Patch Information
The vendor addressed the issue in the changeset published on the WordPress plugin repository. Review the WordPress Tickera Changeset for the exact code modifications applied to the vulnerable query paths in includes/addons/better-attendees-and-tickets/index.php.
Workarounds
- Temporarily deactivate the Tickera plugin or specifically the better-attendees-and-tickets add-on until patching is complete.
- Add a WAF rule that blocks requests containing SQL keywords in the s parameter for Tickera endpoints.
- Restrict the custom-level role so that access to the vulnerable search functionality is removed until the plugin is updated.
# Configuration example: temporarily deactivate the Tickera plugin via WP-CLI
wp plugin deactivate tickera-event-ticketing-system
# Verify the plugin is inactive
wp plugin status tickera-event-ticketing-system
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
