CVE-2026-82226

CVE-2026-82226 is an unauthenticated PHP object injection flaw (deserialization of untrusted data, CWE-502) in the Tickera event ticketing plugin for WordPress, affecting versions up to and including 3.6.0.2. A remote attacker with no credentials and no user interaction can send crafted serialized PHP data to an affected request path, where it is unserialized without validation. Successful object injection can lead to high-impact consequences — potentially arbitrary code execution, file manipulation, or data disclosure depending on the gadget chains available on the target — which is reflected in the 9.8 (critical) CVSS score with C:H/I:H/A:H. Any WordPress site running Tickera 3.6.0.2 or older is affected. Exploitation has not been observed yet: EPSS estimates only a 0.3% probability of exploitation in the next 30 days, there is no public proof-of-concept, and the issue is not in CISA KEV.

What to do: Update Tickera to the latest release, which must be newer than 3.6.0.2 (the fixed version is not specified in the available data). Until patched, consider a WAF rule or virtual patch that blocks unauthenticated requests carrying suspicious serialized payloads to the plugin's endpoints, and review web/application logs for anomalous serialized data since unauthenticated object injection flaws are directly reachable from the internet.