CVE-2026-88998

MediumCVSS 5.3/10Last modified Oct 14, 2026

Description

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2026
Last modified
Oct 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-889994.3The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to tCVE-2026-89006.4The Simple SEO Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, aCVE-2026-890004.1The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-suppCVE-2026-890014.9The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish coCVE-2026-890026.8The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source CVE-2026-890034.1The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and reCVE-2026-890042.7The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's storeCVE-2026-890056.8The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a cCVE-2026-890066.8The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allCVE-2026-890072.7The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deCVE-2026-890082.7The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointmenCVE-2026-890099.1WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability th
CVE-2026-88998: Medium severity, CVSS 5.3 | Vulnix