Executive brief
The Eventer plugin for WordPress, which is used to manage and display events on websites, contains a security flaw that allows unauthorized individuals to access private database information. By sending specially crafted requests, an attacker can bypass security measures to extract sensitive data such as user credentials or site configuration details. This could lead to a full compromise of the website's data and potentially its administrative accounts.
Technical details
The Eventer plugin for WordPress is vulnerable to a time-based blind SQL injection vulnerability within the 'code' parameter. This issue stems from insufficient escaping of user-supplied input and a failure to use prepared statements when executing SQL queries. An unauthenticated remote attacker can exploit this by sending crafted web requests that append malicious SQL commands to existing queries. Because the vulnerability is time-based, the attacker can infer data from the database based on the server's response time. This can be used to extract sensitive information, including administrative hashes or customer data, from the WordPress database. All versions up to and including 4.4.2 are affected.
Affected products
- joe007 Eventer up to, and including, 4.4.2
Timeline
- 2026-07-08: disclosed: Initial publication of the CVE record.
- 2026-07-08: advisory: Wordfence published the vulnerability details.