Advisory (from the source map)

PHP Object Injection is maybe_unserialize on checkout owner meta in create_order, not an ajax action=. HTTP is the cart + process-payment pages. PHP method names are not action=.

Entry

• Method: POST
• Path: /cart/
• Router: Unauth cart POST (update_cart on wp_loaded / admin_post_nopriv_tickera_cart). Nonce action tickera_cart_page. Then free_orders process_payment POST to /process-payment/ with tc_payment_submit. create_order maybe_unserialize()s owner *_post_meta.
• Notes: CVE-2026-82226 CWE-502: Tickera 3.6.0.2 create_order maybe_unserialize()s attendee owner_data *post_meta (tickera.php ~3919). 3.6.0.3 rejects is_serialized() owner fields and tickera_sanitize_array uses allowed_classes=>false. Lab seed: published event + free tc_tickets, show_owner_fields=yes, canary class POCWitness82226, public page slug tc-lab-nonce with TICKET_ID= CART_NONCE= COOKIEHASH=. Cart cookie tc_cart{COOKIEHASH} is JSON {ticket_id:1}. Witness is POCWitness82226 in HTTP body or debug.log — not a shell. Class name is 15 chars so payload is O:15: not O:16.

Call chain

• GET /tc-lab-nonce/ → TICKET_ID CART_NONCE COOKIEHASH
• Set cookie tc_cart_{COOKIEHASH}={ticket_id:1}
• POST /cart/ cart_action=proceed_to_checkout + nonce + owner_data_first_name_post_meta[id][0]=serialized object
• TC::update_cart → save_cart_post_data stores owner_data in session
• POST /process-payment/ tc_payment_submit (free_orders permanently_active, total 0)
• TC_Gateway_Free_Orders::process_payment → TC::create_order → maybe_unserialize(owner *_post_meta)

Lab preconditions

• WordPress with tickera-event-ticketing-system 3.6.0.2 active
• Published tc_events + tc_tickets price_per_ticket=0, event_name=event id
• show_owner_fields=yes so owner_data *_post_meta is accepted
• Public TICKET_ID= CART_NONCE= COOKIEHASH= on slug tc-lab-nonce
• Lab mu-plugin canary class POCWitness82226 (wakeup/destruct log the name; not a gadget chain)

Witness

Response or debug.log contains POCWitness82226 (class instantiated during unserialize). Theme HTML, invalid cart nonce, or empty cart is not the object-injection witness.

Not success

• generic 200 hello world HTML
• Invalid cart request
• The cart is empty
• All fields marked with * are required
• status success without unserialize / class instantiation
• reverse shell or outbound connect

Patch / remediation

Do this first: Update Tickera to 3.6.0.3 or newer.

Verify after upgrade

• Re-run CVE-2026-82226-Abraxas-Labs.py against the patched build: the mapped witness must not appear.
• Confirm the vendor advisory / changeset in the deployed tree (see references).
• A WAF signature is delay, not a patch.

If you cannot update immediately

• Disable or isolate the affected component.
• Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).

Reproduction (authorized lab)

Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.

Success is the witness above in the response body. Generic 200 HTML is not it.

Lab images

Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.

• lab/docker-compose.yml
• lab/docker-compose.override.yml
• lab/Dockerfile

Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.

References

• CVE-2026-82226 · NVD

• CVE-2026-82226 · CVE.org

• patchstack.com/database/wordpress/plugin/tickera-event-ticketing-system/vulnerability/wordpress-tickera-plugin-3-6-0-2-php-object-injection-vulnerability?_s_id=cve

• github.com/advisories/GHSA-v3jw-vq2p-6xp9

• nvd.nist.gov/vuln/detail/CVE-2026-82226

• Plugin directory: tickera-event-ticketing-system

• Trac browser: plugins.trac.wordpress.org/tickera-event-ticketing-system

• SVN tags: plugins.svn.wordpress.org/tickera-event-ticketing-system

• Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null

Records (structured)

Disclaimer

This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.

abraxaslabs.tech · github.com/abraxas · @abraxas_null