The Tickera – Sell Tickets & Manage Events WordPress plugin is vulnerable because the 'tc_order_status_filter' parameter is inserted directly into an SQL query without proper escaping or parameterization. This flaw allows an authenticated user with staff or higher privileges to append additional SQL statements to the existing query. The injected statements can read or manipulate sensitive data stored in the WordPress database, including ticket sales and user information.

All WordPress installations running Tickera plugin versions 3.6.0.1 or earlier are affected. The vulnerability is located in the Addons Better Attendees and Tickets code that processes order status filtering. Only users who hold a staff role or higher on the site can exploit it.

The flaw has a CVSS score of 6.5, indicating a moderate severity level. The EPSS score is below 1 %, showing a very low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. An attacker must be authenticated and have staff‑level or higher access, then craft a request to the vulnerable endpoint containing the 'tc_order_status_filter' parameter to inject malicious SQL.