The Tickera WordPress plugin before version 3.6.0.4 incorrectly validates 2Checkout IPN payment notifications. The implemented signature check does not include the order identifier or the payment amount, allowing an attacker to forge a valid notification. An attacker can then cause the plugin to mark any order as paid without a legitimate transaction, resulting in loss of revenue and delivery of goods or services to unpaid customers.

Versions of the Tickera plugin older than 3.6.0.4 are affected. The vendor “Tickera” released the plugin as a WordPress add‑on; no specific sub‑products are listed in the CVE advisory.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, so the already known exploitation activity is low or undocumented. However, the attack can be carried out remotely and does not require authentication, making it attractive for opportunistic attackers who can spoof payment notifications to the plugin’s callback endpoint.