Loading vulnerability…
Blind SQL Injection in Tickera WordPress Plugin
CVE-2026-105889 is a blind SQL injection vulnerability in the Tickera WordPress event-ticketing plugin affecting versions through 3.6.0.6; the earliest affected version is unspecified. Improper neutralization of special elements in SQL commands allows blind SQL injection, potentially exposing database information. The vulnerable function, endpoint, and input parameter are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers could potentially infer and extract database information through blind SQL injection. The extent of accessible data and additional consequences are not established independently of the published severity assessment.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.