CVE-2026-121858 · Other
NO FIX YET · SEE WHAT TO DO
The Event Tickets with Ticket Scanner WordPress plugin does not escape a search value before using it in SQL queries in several admin listings. A user with admin-area access, administrators by default or any role granted access in plugin settings, can run SQL injection against the site database.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Event Tickets with Ticket Scanner WordPress plugin before 3.2.9. Exposure is limited to users who already have access to the WordPress admin area, which by default means administrators, plus any role the site grants access to the plugin's settings. Sites that do not use the plugin, or that run 3.2.9 or later, can skip it.
Not affected if admin-access-restricted-to-trusted-users, plugin-not-installed, plugin-version-3.2.9-or-later
Who cares event-tickets-with-ticket-scanner, wordpress
readme.txt; versions before 3.2.9 are listed as affected3.2.9 or laterThe Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.