Executive brief
The Events Manager WordPress plugin contains a SQL injection vulnerability that allows attackers with subscriber-level accounts (or unauthenticated visitors in certain configurations) to tamper with booking consent records belonging to other customers. An attacker can modify or delete consent records for multiple bookings, potentially marking guests as having revoked consent they never gave. This could be used to disrupt customer communications and data integrity for event booking systems.
Technical details
The plugin fails to properly sanitize and escape user-controlled input from the email field before using it in SQL statements, resulting in SQL injection (CWE-89). The vulnerability is reachable via the WordPress profile update endpoint with a specially crafted email payload that breaks out of the SQL string literal. Attack preconditions include: (1) attacker must have subscriber or higher account privileges, or the plugin's "No-User Booking Mode" must be enabled for unauthenticated exploit via public booking forms, and (2) at least one guest booking with recorded communications consent must exist. The injected SQL allows the attacker to modify WHERE clauses to target arbitrary bookings. The permitted character set limits impact to tampering with booking records rather than data exfiltration. The plugin was patched in version 7.4.1.
Affected products
- Events Manager Events Manager before 7.4.1
Timeline
- 2026-08-10: disclosed
- 2026-08-12: advisory
- 2026-08-10: patched: Fixed in version 7.4.1