The Tickera – Sell Tickets & Manage Events WordPress plugin is affected by an SQL Injection vulnerability (CWE-89) in the 's' parameter in all versions up to and including 3.6.0.0. The issue arises from insufficient escaping of user-supplied input and lack of prepared statements in SQL queries, enabling authenticated attackers with custom-level access or higher to append malicious SQL code. This can be exploited to extract sensitive information from the database. No known exploits are reported in the wild, and no official patch or remediation level has been disclosed.

An attacker with authenticated custom-level access or higher can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact availability or integrity directly but compromises confidentiality. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to the 's' parameter. Avoid granting custom-level or higher access to untrusted users. Follow vendor updates closely for any forthcoming patches or mitigations.