EUVD-2026-47904
GHSA-cxg7-gp87-x92x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network AJAX endpoint (AV:N), trivial exploitation once authenticated (AC:L), Contributor credentials required (PR:L), database read-only impact (C:H/I:N/A:N).
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec_records_edit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $_POST['standard'] and uses the JSON array keys directly as column identifiers in the SET clause of an UPDATE statement built inside RTEC_Db_Admin::update_entry(). Only esc_sql() (mysqli_real_escape_string) is applied to the identifier; that function escapes quotes, backslashes, and a few control characters but does not escape spaces, equals signs, parentheses, or hyphens, so an attacker can break out of the identifier context and inject subqueries (terminated with a SQL comment). This makes it possible for authenticated attackers, with Contributor-level access and above who can edit the targeted event, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the Registrations For The Events Calendar WordPress plugin (versions up to and including 3.2) enables authenticated Contributors with event-edit access to extract sensitive database content by embedding malicious SQL subqueries within JSON object keys sent to the rtec_records_edit AJAX handler. The root flaw is improper use of esc_sql() - which wraps mysqli_real_escape_string - to sanitize column identifiers in a dynamically constructed UPDATE statement; this escaping function only handles quote and backslash characters, leaving spaces, parentheses, equals signs, and hyphens unescaped, which are precisely the characters needed to break out of the SQL identifier context. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and accessible privilege tier (Contributor) make this a concrete extraction risk on multi-user WordPress sites.
Technical ContextAI
The vulnerability resides in the WordPress plugin 'Registrations For The Events Calendar' (plugin slug: registrations-for-the-events-calendar), specifically in RTEC_Db_Admin::update_entry() (class-rtec-db-admin.php:L84) and its callers in admin-functions.php (L724, L774). The plugin processes a JSON payload from $_POST['standard'] and uses the decoded array's keys directly as column names in the SET clause of a raw UPDATE SQL statement. The developer applied esc_sql(), which is an alias for mysqli_real_escape_string(), as the only sanitization step. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) applies because this function was designed to escape string delimiters within SQL string literals, not to validate or sanitize SQL identifiers - it has no effect on structural SQL metacharacters such as spaces, parentheses, commas, or equals signs. By supplying a crafted JSON key like 'col = (SELECT password FROM wp_users WHERE 1=1)-- ', an attacker escapes the identifier context entirely and injects an arbitrary subquery, using a trailing SQL comment to suppress the remainder of the original statement.
RemediationAI
A fix was committed to the WordPress plugin repository as changeset 3599275 (plugins.trac.wordpress.org/changeset). The exact version number of the released patched build is not independently confirmed from the available data - site administrators should upgrade to the latest version available in the WordPress plugin directory and verify the version exceeds 3.2. The Wordfence advisory at wordfence.com/threat-intel/vulnerabilities/id/630cc68e-102e-4e05-98ff-94de434a10ae should be consulted for the confirmed fixed version. As a compensating control while patching, administrators can restrict Contributor-role capabilities to prevent editing of event registrations, or deploy a web application firewall rule to block POST requests to wp-admin/admin-ajax.php where the 'action' parameter is 'rtec_records_edit' and the 'standard' body field contains structural SQL characters such as parentheses or equals signs outside of quoted strings. Note that WAF rules targeting this AJAX action may break legitimate registration editing workflows for site editors, so coordinate the control with affected users.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today