Is CVE-2026-18057 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18057 being exploited in the wild.

How severe is CVE-2026-18057?

High severity, with a CVSS score of 8.1, published 12 August 2026.

Which products and versions are affected?

Events Manager Events Manager before 7.4.1.

Is there a fix for CVE-2026-18057?

A patch was published on 2026-08-10: Fixed in version 7.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18057 attacked?

It is attacked over the network.

Am I affected by CVE-2026-18057?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18057: Events Manager WordPress plugin SQL injection in booking consent

CVE-2026-18057 · Severity: high · CVSS 8.1 · Published 2026-08-12

The Events Manager WordPress plugin contains a SQL injection vulnerability that allows attackers with subscriber-level accounts (or unauthenticated visitors in certain configurations) to tamper with booking consent records belonging to other customers. An attacker can modify or delete consent records for multiple bookings, potentially marking guests as having revoked consent they never gave. This could be used to disrupt customer communications and data integrity for event booking systems.

Quick answers

Is CVE-2026-18057 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18057 being exploited in the wild.
How severe is CVE-2026-18057?: High severity, with a CVSS score of 8.1, published 12 August 2026.
Which products and versions are affected?: Events Manager Events Manager before 7.4.1.
Is there a fix for CVE-2026-18057?: A patch was published on 2026-08-10: Fixed in version 7.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18057 attacked?: It is attacked over the network.
Am I affected by CVE-2026-18057?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to properly sanitize and escape user-controlled input from the email field before using it in SQL statements, resulting in SQL injection (CWE-89). The vulnerability is reachable via the WordPress profile update endpoint with a specially crafted email payload that breaks out of the SQL string literal. Attack preconditions include: (1) attacker must have subscriber or higher account privileges, or the plugin's "No-User Booking Mode" must be enabled for unauthenticated exploit via public booking forms, and (2) at least one guest booking with recorded communications consent must exist. The injected SQL allows the attacker to modify WHERE clauses to target arbitrary bookings. The permitted character set limits impact to tampering with booking records rather than data exfiltration. The plugin was patched in version 7.4.1.

Affected products

Events Manager Events Manager before 7.4.1

Timeline

2026-08-10: disclosed
2026-08-12: advisory
2026-08-10: patched: Fixed in version 7.4.1

References

https://wpscan.com/vulnerability/e2685778-936f-4920-9b5c-0fcbb9da6d26/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.