Executive brief
Tickera is a WordPress plugin for selling event tickets and managing bookings. An unauthenticated attacker can inject malicious PHP objects to execute arbitrary code on the server, potentially leading to complete website compromise, data theft, or malware installation. No authentication is required and the vulnerability affects all versions up to 3.6.0.2.
Technical details
This vulnerability is a PHP object injection flaw that allows unauthenticated attackers to manipulate how the Tickera plugin processes serialized data. The root cause involves improper handling of user-supplied input that can be deserialized into PHP objects, enabling arbitrary code execution on the server. The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this to run arbitrary server-side commands, access the database, read/write files, or establish a foothold for further system compromise. The vulnerability was patched in version 3.6.0.3.
Affected products
- Tickera Tickera <= 3.6.0.2
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in version 3.6.0.3