{"id":"CVE-2026-121858","kind":"vulnerability","aliases":["CVE-2026-121858"],"related":[],"title":"WordPress Event Tickets plugin: admin search lets users run SQL injection","description":"The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks.","summary":"The Event Tickets with Ticket Scanner WordPress plugin does not escape a search value before using it in SQL queries in several admin listings. A user with admin-area access, administrators by default or any role granted access in plugin settings, can run SQL injection against the site database.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-tickets-with-ticket-scanner","other","wordpress"],"not_affected_if":["admin-access-restricted-to-trusted-users","plugin-not-installed","plugin-version-3.2.9-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or the plugin's `readme.txt`; versions before `3.2.9` are listed as affected\n- Review which roles have access to the plugin's admin pages in its settings","fix":"- Event Tickets with Ticket Scanner: move to `3.2.9` or later","status":"open","published_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:18+00:00","updated_at":"2026-11-07T06:48:18+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-07T06:48:18Z","model":"claude-haiku-5-5","output":{"fix":"- Event Tickets with Ticket Scanner: move to `3.2.9` or later","reach":"network","title":"WordPress Event Tickets plugin: admin search lets users run SQL injection","impact":"high","summary":"The Event Tickets with Ticket Scanner WordPress plugin does not escape a search value before using it in SQL queries in several admin listings. A user with admin-area access, administrators by default or any role granted access in plugin settings, can run SQL injection against the site database.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","event-tickets-with-ticket-scanner"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated admin-area user reads or changes the site database","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or the plugin's `readme.txt`; versions before `3.2.9` are listed as affected\n- Review which roles have access to the plugin's admin pages in its settings","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-3.2.9-or-later","plugin-not-installed","admin-access-restricted-to-trusted-users"],"who_is_affected":"Sites running the Event Tickets with Ticket Scanner WordPress plugin before 3.2.9. Exposure is limited to users who already have access to the WordPress admin area, which by default means administrators, plus any role the site grants access to the plugin's settings. Sites that do not use the plugin, or that run 3.2.9 or later, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4221,"output_tokens":587,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121858':14A,17A '-2026':13A,16A '3.2.9':85C 'access':56B,64B,108C,120C 'admin':5A,48B,54B,103C,111C 'admin-area':53B 'administr':57B,113C 'allow':105C 'area':55B,112C 'attack':128C 'cve':12A,15A 'databas':75B 'default':59B,115C 'escap':36B,89C 'event':2A,19B,27B,77C 'event-tickets-with-ticket-scann':18B 'grant':63B,119C 'inject':11A,71B,127C 'let':7A 'list':49B,104C 'perform':125C 'plugin':4A,33B,66B,83C 'proper':88C 'queri':45B,98C 'role':62B,118C 'run':9A,69B 'scanner':23B,31B,81C 'search':6A,38B,91C 'set':67B,123C 'sever':47B,100C 'site':74B 'sql':10A,44B,70B,97C,126C 'ticket':3A,20B,22B,28B,30B,78C,80C 'use':41B,94C 'user':8A,51B,106C 'valu':39B,92C 'wordpress':1A,25B,32B,82C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Event Tickets with Ticket Scanner WordPress plugin before 3.2.9. Exposure is limited to users who already have access to the WordPress admin area, which by default means administrators, plus any role the site grants access to the plugin's settings. Sites that do not use the plugin, or that run 3.2.9 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventticketswithticketscanner","medium","other","wordpress"],"campaign_type":null,"search_a":"'-121858':14A,17A '-2026':13A,16A 'admin':5A 'cve':12A,15A 'event':2A 'inject':11A 'let':7A 'plugin':4A 'run':9A 'search':6A 'sql':10A 'ticket':3A 'user':8A 'wordpress':1A","search_b":"'access':56B,64B 'admin':48B,54B 'admin-area':53B 'administr':57B 'area':55B 'databas':75B 'default':59B 'escap':36B 'event':19B,27B 'event-tickets-with-ticket-scann':18B 'grant':63B 'inject':71B 'list':49B 'plugin':33B,66B 'queri':45B 'role':62B 'run':69B 'scanner':23B,31B 'search':38B 'set':67B 'sever':47B 'site':74B 'sql':44B,70B 'ticket':20B,22B,28B,30B 'use':41B 'user':51B 'valu':39B 'wordpress':25B,32B","search_c":"'3.2.9':85C 'access':108C,120C 'admin':103C,111C 'administr':113C 'allow':105C 'area':112C 'attack':128C 'default':115C 'escap':89C 'event':77C 'grant':119C 'inject':127C 'list':104C 'perform':125C 'plugin':83C 'proper':88C 'queri':98C 'role':118C 'scanner':81C 'search':91C 'set':123C 'sever':100C 'sql':97C,126C 'ticket':78C,80C 'use':94C 'user':106C 'valu':92C 'wordpress':82C","first_public_at":"2026-11-07T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121858","severity":null,"published_at":"2026-11-07T06:16:58+00:00","modified_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}