CVE Intelligence
Analysis AI-assisted

CVE-2026-105889: Tickera WordPress Plugin SQL Injection

CVE-2026-105889 is an SQL injection flaw (CWE-89) in the Tickera event ticketing plugin for WordPress, affecting versions up to and including 3.6.0.6, which allows blind SQL injection. Patchstack scored it 9.3 (critical) under CVSS 3.1 with a network attack vector and no privileges required. The record lists no fixed version and no confirmed exploitation in the CISA KEV catalogue.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-105889 describes an SQL injection vulnerability (CWE-89) in the Tickera event ticketing plugin for WordPress. The record states that it allows blind SQL injection, a case where an attacker may infer database content from application behaviour rather than seeing query results directly.

Impact

Patchstack scored the issue 9.3 under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. That vector describes a network-reachable flaw of low complexity that requires no privileges or user interaction, with high confidentiality impact, low availability impact and no integrity impact. The scope is listed as changed.

  • Confidentiality: rated high in the vector.
  • Integrity: rated none in the vector.
  • Availability: rated low in the vector.

Affected products and versions

The record lists Tickera (Tickera tickera-event-ticketing-system) with versions up to and including 3.6.0.6. The lower bound is recorded as n/a, so the start of the affected range is unknown.

Exploitation status

The CISA KEV catalogue does not list this CVE, and the sources consulted show no confirmed exploitation in the wild. EPSS gives a probability of 0.00255 (percentile 0.15835) as of 2026-10-13. The SSVC record shows exploitation as none and marks the issue as automatable.

Remediation and mitigation

The record contains no fixed version. Administrators should check the vendor and the Patchstack entry for an official update and treat affected sites as at risk until one is confirmed.

  • Inventory WordPress sites that use Tickera and confirm the installed version.
  • If no fix is available, consider disabling the plugin until a vendor update is confirmed.
  • Restrict access to administrative and public endpoints where practical, and use a web application firewall as a compensating control.
  • Limit the database account used by WordPress to the privileges it needs.
  • Keep tested backups available.

Detection guidance

  • Review web server and application logs for unusual parameters or repeated requests against ticketing endpoints.
  • Watch for database errors, unexpected query delays or abnormal response timing that could indicate blind injection attempts.
  • Monitor for unexpected changes to ticket, order or user data.

Limitations of the available information

The record does not state the start of the affected range, a fixed version, or the vendor advisory text. The vendor database entry is available at Patchstack and the NVD record at NVD. Exploitation status reflects only the sources consulted and may change.

Frequently asked questions

Is this Tickera vulnerability being exploited?

The CISA KEV catalogue does not list CVE-2026-105889, and the sources consulted show no confirmed exploitation in the wild. Its EPSS probability is low at 0.00255.

Which Tickera versions are affected?

The record lists Tickera versions up to and including 3.6.0.6. The start of the affected range is recorded as n/a, so it is not stated.

Is a fixed version available?

The record does not list a fixed version. Check the vendor and the Patchstack entry for an official update before deciding on remediation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.