CVE-2026-88998: Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN
The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using the Tickera plugin before version 3.6.0.4 are affected. An attacker does not need authentication or user interaction.
What does an attacker need to do to exploit it?
The attacker needs to forge a 2Checkout IPN payment notification. Because the signature validation does not cover the order or payment amount, the attacker can cause arbitrary orders to be marked as paid without making payment.
What is the impact of successful exploitation?
Successful exploitation changes the integrity of order payment status. Orders can be marked paid even though no valid payment was made.
How can I remediate the issue?
Update the Tickera WordPress plugin to version 3.6.0.4 or later. The issue affects versions before 3.6.0.4.