CVE-2026-15761 Overview
CVE-2026-15761 is a SQL injection vulnerability in the Tickera – Sell Tickets & Manage Events plugin for WordPress. The flaw affects all versions up to and including 3.6.0.1. The plugin fails to properly escape the tc_event_filter parameter and does not use prepared statements for the underlying SQL query. Authenticated attackers holding staff-level access or higher can append arbitrary SQL to existing queries. This allows extraction of sensitive data from the WordPress database. The vulnerable path is exposed to users with the plugin's custom Staff role because add_required_capabilities() grants the edit_tc_tickets_instances capability [CWE-89].
Critical Impact
Authenticated staff-level attackers can extract sensitive database contents, including user credentials, session tokens, and customer ticket data, through injected SQL queries.
Affected Products
- Tickera – Sell Tickets & Manage Events plugin for WordPress
- All versions up to and including 3.6.0.1
- WordPress installations exposing the tc_tickets_instances admin list screen
Discovery Timeline
- 2026-07-23 - CVE-2026-15761 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-15761
Vulnerability Analysis
The vulnerability resides in the plugin's better-attendees-and-tickets addon, specifically in includes/addons/better-attendees-and-tickets/index.php. The plugin constructs SQL statements that incorporate the user-supplied tc_event_filter parameter without sufficient escaping or parameterization. Because the parameter is concatenated into an existing query, an attacker can inject additional SQL clauses. The Tickera plugin registers a custom Staff role and, through add_required_capabilities(), grants it the edit_tc_tickets_instances capability. This capability provides access to the tc_tickets_instances admin list screen where the vulnerable filter is applied. See the WordPress Plugin Code Review at L193 and L215 for the affected code paths.
Root Cause
The root cause is insufficient input escaping combined with the absence of prepared statements. The plugin passes user-controlled input from the tc_event_filter request parameter directly into a SQL query string. WordPress provides $wpdb->prepare() for parameterized queries, but the vulnerable code path does not use it. Classified under [CWE-89], this is a textbook SQL injection pattern.
Attack Vector
An attacker must first authenticate as a user with the Tickera Staff role or higher. The attacker then navigates to the tc_tickets_instances admin list screen and submits a crafted value in the tc_event_filter parameter. The injected payload is appended to the existing SQL query and executed against the WordPress database. Successful exploitation returns data such as password hashes, session tokens, or customer records associated with tickets and events.
No verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-15761
Indicators of Compromise
- HTTP requests to /wp-admin/ containing the tc_event_filter parameter with SQL metacharacters such as UNION, SELECT, --, ', or SLEEP(.
- Unusual database query patterns originating from the Tickera plugin, including queries referencing wp_users, wp_usermeta, or information_schema.
- Access to the tc_tickets_instances admin list screen by newly created or low-privileged Staff accounts.
- Elevated query response times or database error entries in PHP or MySQL logs correlated with staff sessions.
Detection Strategies
- Deploy a web application firewall (WAF) rule inspecting the tc_event_filter parameter for SQL injection signatures.
- Enable WordPress query logging and alert on queries matching edit_tc_tickets_instances workflows that contain UNION or subselect syntax.
- Correlate authentication events for Staff role users with subsequent admin-screen requests carrying suspicious filter values.
Monitoring Recommendations
- Monitor creation of new users assigned the Tickera Staff role and review capability grants.
- Track anomalous outbound data volumes from the WordPress host that may indicate database exfiltration.
- Review wp_options and Tickera-related tables for unexpected reads or modifications following filter usage.
How to Mitigate CVE-2026-15761
Immediate Actions Required
- Update the Tickera – Sell Tickets & Manage Events plugin to a version later than 3.6.0.1 as soon as the vendor releases a patched build.
- Audit all WordPress accounts holding the Tickera Staff role or higher and remove unnecessary access.
- Rotate WordPress administrator and database credentials if suspicious activity is detected in access logs.
Patch Information
The vendor addressed the flaw via the plugin repository. See the WordPress Plugin Changeset for the corrective code changes. Site operators should apply the fixed version through the WordPress plugin update mechanism.
Workarounds
- Temporarily restrict access to the tc_tickets_instances admin list screen using a WAF or reverse proxy rule until the plugin is updated.
- Remove the Tickera Staff role from untrusted users and revoke the edit_tc_tickets_instances capability.
- Deploy WAF signatures that block SQL metacharacters in the tc_event_filter request parameter.
# Example ModSecurity rule blocking SQL metacharacters in tc_event_filter
SecRule ARGS:tc_event_filter "@rx (?i)(union(\s|/\*.*\*/)+select|--|;|/\*|\bsleep\s*\(|\bbenchmark\s*\()" \
"id:1026157610,phase:2,deny,status:403,log,\
msg:'CVE-2026-15761 Tickera tc_event_filter SQLi attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
