# CVE-2026-13754: Tickera Sell Tickets & Manage Events SQL injection in s parameter

Source: https://junglewise.ai/threats/cve-2026-13754-tickera-sell-tickets-manage-events-sql-injection-in-s-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-13754 · Severity: medium · CVSS 6.5 · Published 2026-07-16

The Tickera plugin for WordPress, which is used to manage event ticket sales, contains a security flaw that allows certain logged-in users to access sensitive information from the website's database. By sending specially crafted search requests, an attacker could bypass security measures to view data they are not authorized to see. This could lead to the exposure of customer details or internal site configuration.

Technologies: [Tickera](https://junglewise.ai/threats/technologies/tickera). Vendors: [Tickera](https://junglewise.ai/threats/vendors/tickera).

## Quick answers

**Is CVE-2026-13754 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13754 being exploited in the wild.

**How severe is CVE-2026-13754?** Medium severity, with a CVSS score of 6.5, published 16 July 2026.

**Which products and versions are affected?** Tickera up to, and including, 3.6.0.0.

**Is there a fix for CVE-2026-13754?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13754 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13754?** Check whether you run Tickera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to a generic SQL Injection vulnerability due to insufficient escaping of the 's' parameter and a lack of SQL query preparation in the 'better-attendees-and-tickets' add-on. This flaw exists in all versions up to and including 3.6.0.0. An authenticated attacker with custom-level access or higher can exploit this by appending malicious SQL commands to existing queries. Successful exploitation allows the attacker to extract sensitive information from the WordPress database. A patch appears to be available in the plugin's changeset repository.

## Affected products

- Tickera Tickera – Sell Tickets & Manage Events up to, and including, 3.6.0.0

## Timeline

- 2026-07-16: disclosed
- 2026-07-16: advisory

## References

- [https://plugins.trac.wordpress.org/browser/tickera-event-ticketing-system/tags/3.6.0.0/includes/addons/better-attendees-and-tickets/index.php](https://plugins.trac.wordpress.org/browser/tickera-event-ticketing-system/tags/3.6.0.0/includes/addons/better-attendees-and-tickets/index.php)
- [https://plugins.trac.wordpress.org/browser/tickera-event-ticketing-system/tags/3.6.0.0/includes/addons/better-attendees-and-tickets/index.php](https://plugins.trac.wordpress.org/browser/tickera-event-ticketing-system/tags/3.6.0.0/includes/addons/better-attendees-and-tickets/index.php)
- [https://plugins.trac.wordpress.org/browser/tickera-event-ticketing-system/tags/3.6.0.0/includes/addons/better-attendees-and-tickets/index.php](https://plugins.trac.wordpress.org/browser/tickera-event-ticketing-system/tags/3.6.0.0/includes/addons/better-attendees-and-tickets/index.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3605637%40tickera-event-ticketing-system&new=3605637%40tickera-event-ticketing-system](https://plugins.trac.wordpress.org/changeset?reponame=&old=3605637%40tickera-event-ticketing-system&new=3605637%40tickera-event-ticketing-system)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/8113fd51-9e2b-45c4-a17b-b38072da0de9?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/8113fd51-9e2b-45c4-a17b-b38072da0de9?source=cve)

## Related threats

- [Tickera PHP object injection vulnerability](https://junglewise.ai/threats/cve-2026-82226-tickera-php-object-injection-vulnerability)
- [Tickera WordPress Plugin SQL Injection in tc_event_filter](https://junglewise.ai/threats/cve-2026-15761-tickera-wordpress-plugin-sql-injection-in-tc-event-filter)
- [Tickera Sell Tickets & Manage Events SQL injection in tc_order_status_filter](https://junglewise.ai/threats/cve-2026-15448-tickera-sell-tickets-manage-events-sql-injection-in-tc-order)
- [Tickera WordPress Plugin Stored XSS in price_wrapper shortcode](https://junglewise.ai/threats/cve-2026-13755-tickera-wordpress-plugin-stored-xss-in-price-wrapper-shortcode)