---
id: CVE-2026-88998
title: >-
  The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the
  integrity of incoming payment notifications, and the validated signature does
  not cover the order or the amount, allowing unauthenticated attackers to forge
  a paym…
summary: >-
  The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the
  integrity of incoming payment notifications, and the validated signature does
  not cover the order or the amount, allowing unauthenticated attackers to forge
  a paym…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T11:17:07.293'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88998'
references:
  - url: 'https://wpscan.com/vulnerability/50fe4955-9193-4842-9ea6-1812d70d813e/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-14T11:27:22.147Z'
---

## Overview

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.