WordPress Plugin Vulnerabilities

Event Tickets with Ticket Scanner < 2.8.6 - Unauthenticated Remote Code Execution

Description

The Event Tickets with Ticket Scanner plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.8.5. This makes it possible for unauthenticated attackers to execute code on the server.

Affects Plugins

Plugin icon
event-tickets-with-ticket-scanner
Fixed in 2.8.6

References

CVE
CVE-2025-68015
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/030b26ac-344f-4919-9d2d-b85e5e1599f6

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
6062026c-b7c1-4321-b586-76025c8f85c3

Timeline

Publicly Published
2026-01-15 (about 8 months ago)
Added
2026-01-19 (about 8 months ago)
Last Updated
2026-02-12 (about 7 months ago)

Other

Published
Title
Published
2022-02-08
Title
PHP Everywhere < 3.0.0 - Subscriber+ RCE via Shortcode
Published
2026-08-25
Title
Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite
Published
2024-06-19
Title
Custom Field Suite <= 2.6.7 - Contributor+ PHP Code Injection via Loop Custom Field
Published
2025-09-22
Title
WP User Frontend < 4.1.13 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Published
2018-05-18
Title
ProfileGrid – User Profiles, Groups and Communities <= 2.8.5 - Authenticated Code Execution