CVE-2026-15761 describes a SQL Injection vulnerability in the Tickera – Sell Tickets & Manage Events WordPress plugin. The issue exists in all versions up to and including 3.6.0.1 due to improper neutralization of special elements in the 'tc_event_filter' parameter. Authenticated attackers with staff-level privileges can exploit this by injecting additional SQL commands into existing queries, leveraging insufficient escaping and lack of prepared statements. The vulnerability is reachable because the plugin grants the Staff role the 'edit_tc_tickets_instances' capability, allowing access to the affected admin list screen where the filter is applied.

An attacker with staff-level access can exploit this vulnerability to extract sensitive information from the database by injecting arbitrary SQL commands. The vulnerability does not allow privilege escalation, denial of service, or integrity modification based on the provided data, but it compromises confidentiality of data accessible via the database queries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict staff-level access to trusted users only and monitor for unusual activity related to ticket instance filtering. Avoid granting the 'edit_tc_tickets_instances' capability to untrusted users. Follow vendor updates for official patches or mitigations.