Executive brief
EventON is a popular WordPress plugin used to manage and display event calendars. A security flaw allows unauthenticated attackers to run unauthorized database commands via the search feature. This could lead to the theft of sensitive website data, including user information and configuration details, if the 'additional search queries' setting is enabled.
Technical details
The EventON plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in versions up to and including 5.0.11. The vulnerability stems from insufficient escaping of user-supplied input and a lack of preparation in the existing SQL query logic. An unauthenticated attacker can exploit this by appending malicious SQL commands to legitimate queries to extract sensitive information from the database. Exploitation requires the 'Enable additional search queries' setting to be active and at least one published event to exist on the site. The issue is classified as CWE-89.
Affected products
- EventON EventON (Pro) - WordPress Virtual Event Calendar Plugin up to, and including, 5.0.11
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory