Is CVE-2026-13754 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13754 being exploited in the wild.

How severe is CVE-2026-13754?

Medium severity, with a CVSS score of 6.5, published 16 July 2026.

Which products and versions are affected?

Tickera up to, and including, 3.6.0.0.

Is there a fix for CVE-2026-13754?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13754 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13754?

Check whether you run Tickera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13754: Tickera Sell Tickets & Manage Events SQL injection in s parameter

CVE-2026-13754 · Severity: medium · CVSS 6.5 · Published 2026-07-16

The Tickera plugin for WordPress, which is used to manage event ticket sales, contains a security flaw that allows certain logged-in users to access sensitive information from the website's database. By sending specially crafted search requests, an attacker could bypass security measures to view data they are not authorized to see. This could lead to the exposure of customer details or internal site configuration.

Technologies: Tickera. Vendors: Tickera.

Quick answers

Is CVE-2026-13754 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13754 being exploited in the wild.
How severe is CVE-2026-13754?: Medium severity, with a CVSS score of 6.5, published 16 July 2026.
Which products and versions are affected?: Tickera up to, and including, 3.6.0.0.
Is there a fix for CVE-2026-13754?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13754 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13754?: Check whether you run Tickera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to a generic SQL Injection vulnerability due to insufficient escaping of the 's' parameter and a lack of SQL query preparation in the 'better-attendees-and-tickets' add-on. This flaw exists in all versions up to and including 3.6.0.0. An authenticated attacker with custom-level access or higher can exploit this by appending malicious SQL commands to existing queries. Successful exploitation allows the attacker to extract sensitive information from the WordPress database. A patch appears to be available in the plugin's changeset repository.

Affected products

Tickera Tickera – Sell Tickets & Manage Events up to, and including, 3.6.0.0

Timeline

2026-07-16: disclosed
2026-07-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.