Community Events CVE-2025-10587

Requires the Community Events plugin version =1.5.1 to be installed and active on the target WordPress site, AND an authenticated account with Subscriber-level privileges or above (per the description, despite the CVSS vector listing PR:N). The injection vector is the event_category parameter. Practical exploitability depends on whether the site permits user self-registration - if registration is open, any visitor can obtain the needed Subscriber account; if registration is disabled, an attacker needs an existing low-privilege credential. Exploitation is further limited because WordPress's wpdb layer generally disables stacked/multi-statement queries, constraining impact to UNION-style data extraction rather than arbitrary data modification.

Signals conflict and must be reconciled before prioritization. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) yields a 9.8 'Critical' score implying remote UNAUTHENTICATED exploitation, but the description explicitly states exploitation requires 'authenticated attackers, with Subscriber-level access and above.' This is a direct contradiction - PR:N in the vector is inconsistent with the stated Subscriber prerequisite, and the honest privilege metric is PR:L. The Wordfence/NVD convention of scoring at PR:N inflates the headline severity here. Real-world risk signals are modest: EPSS is only 0.39% (31st percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced. CWE-89 SQL Injection reachable by any Subscriber is genuinely serious where open user registration is enabled, since WordPress's wpdb typically blocks stacked queries, the impact is primarily UNION-based data exfiltration (database read) rather than full write/DoS, making C:H but I/A questionable. Net: a real, patch-worthy flaw, but the 9.8 overstates it - this is closer to a high-confidentiality-impact authenticated SQLi than a wormable unauthenticated RCE-class issue. No public exploit identified at time of analysis.

On a WordPress site running Community Events =1.5.1 with open user registration, an attacker registers a low-privilege Subscriber account, then submits a crafted value in the event_category parameter containing a UNION-based SQL payload. The injected query is appended to an improperly prepared backend query, allowing the attacker to read arbitrary database contents such as user password hashes, secret keys, and PII. No public exploit code is referenced in the available intelligence.