The Tickera – Sell Tickets & Manage Events plugin for WordPress contains a classic SQL injection flaw. The vulnerability arises when the tc_event_filter parameter is inserted into an existing SQL statement without proper escaping or preparation. Capitalizing on this, an authenticated attacker with staff-level or higher privileges can append malicious SQL fragments, enabling the extraction of database contents. This weakness is identified as CWE‑89.

WordPress sites that have the Tickera plugin installed in versions 3.6.0.1 or earlier are affected. The vulnerability is reachable through the admin interface used by users with a custom Staff role, as the role is granted edit_tc_tickets_instances capability.

The CVSS score of 6.5 categorizes the flaw as moderate, with a focus on confidentiality impact. The EPSS score of less than 1% indicates that exploitation is currently unlikely, and the vulnerability does not appear in the CISA KEV catalog. An attacker can exploit it only after authenticating as a staff user with sufficient permissions, so the risk is confined to environments where such credentials are compromised or overly permissive.