CVE-2026-88998

Deferred Deferred - Pending Action

Unauthenticated Payment Forgery in Tickera WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-88998

EUVD

EUVD-2026-100977

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Tickera	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

The Tickera WordPress plugin before version 3.6.0.4 has a flaw in verifying payment notifications. The plugin does not check the integrity of incoming payment confirmations properly. The validated signature does not include key details like the order or amount, allowing attackers to forge payment confirmations without making actual payments.

Detection Guidance

Check the installed version of the Tickera plugin. If it is below 3.6.0.4, the system is vulnerable. Use WordPress admin panel or run: wp plugin list | grep tickera in the WordPress directory.

Impact Analysis

This vulnerability allows unauthenticated attackers to mark any order as paid without completing a payment. This could lead to financial losses for the website owner, as orders are processed without actual transactions. It may also damage customer trust if orders are fulfilled without payment.

Compliance Impact

This vulnerability could lead to unauthorized access or manipulation of payment data, potentially violating compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by exposing sensitive transaction information or allowing unauthorized order confirmations without proper validation.

Mitigation Strategies

Update the Tickera plugin to version 3.6.0.4 or later immediately. Disable IPN-based payment confirmations if not required or restrict access to the IPN endpoint.

Hi! I’m here to help you understand CVE-2026-88998. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70