WordPress Plugin Vulnerabilities

Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search

Description

The plugin does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
event-tickets-with-ticket-scanner
Fixed in 3.2.9

References

CVE
CVE-2026-121858

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
6.3 (medium)

Miscellaneous

Original Researcher
Mokksh Parekh
Submitter
Mokksh Parekh
Submitter website
https://mokksh.netlify.app
Verified
Yes
WPVDB ID
8472ed42-2e1a-4efb-97b8-f01639772580

Timeline

Publicly Published
2026-11-05 (about 2 days ago)
Added
2026-11-05 (about 1 day ago)
Last Updated
2026-11-05 (about 1 day ago)

Other

Published
Title
Published
2026-05-27
Title
GEO my WP < 4.5.5 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters
Published
2014-08-01
Title
Link Library < 5.7.9.7 - SQL Injection
Published
2024-04-22
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.6.19 - Authenticated (Contributor+) SQL Injection via rtmedia_gallery Shortcode
Published
2021-03-15
Title
Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question
Published
2024-05-15
Title
Tutor LMS Pro < 2.7.1 - Missing Authorization to Privilege Escalation