Tickera – Sell Tickets & Manage Events < 3.6.0.4 - Unauthenticated Arbitrary Order Payment Confirmation

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Payment Verification Bypass in all versions up to 3.6.0.4. This is due to an incorrect option key in the payment notification hash computation — `get_option( 'sid', 'secret_word', '2checkout' )` returned the SID instead of the secret word, meaning the HMAC signature never incorporated the secret credential and was trivially reproducible by any attacker who knew the SID. This makes it possible for unauthenticated attackers to mark arbitrary orders as paid without completing payment by forging a 2Checkout payment notification with a predictable hash signature. The 2Checkout payment gateway must be enabled and configured in the plugin settings.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Tickera 3.6.0.4 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts