CVE-2026-88998
Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 14, 2026
- Updated
- Oct 14, 2026
- Reserved
- Sep 10, 2026
Description
The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | WPScan |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
TickeraUnknown |
|
References
- https://wpscan.com/vulnerability/50fe4955-9193-4842-9ea6-1812d70d813e/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.