Skip to content
Sign in
5.3 Medium

CVE-2026-88998 The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications,…

Description

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying.

Affected products and versions

Product Affected versions Fixed in
Tickera 3.6 earliest → < 3.6.0.4 3.6.0.4

Other CVEs of Tickera

The 3 CVEs of Tickera →
CVE-2023-7252 The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets 5.3 Medium CVE-2022-4549 The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could… 4.3 Medium
Track this CVE