Events Manager CVE-2026-18057

Exploitation requires the attacker to hold at minimum a WordPress subscriber-level account on the target site - unauthenticated access is not sufficient, as confirmed by PR:L in the CVSS vector. The Events Manager plugin must be actively installed and enabled, and the vulnerable booking or consent handling endpoint must be reachable. Sites with open registration (WordPress default) are most exposed, as any visitor can self-register as a subscriber. What limits exploitation: subscriber authentication is a hard prerequisite, SSVC marks the attack as not automatable (manual crafting required), and the scope of impact is bounded to booking consent records within the Events Manager data tables rather than arbitrary WordPress database access or system-level compromise. Sites that restrict registration to admin-created accounts or that use role-management plugins to cap subscriber capabilities significantly reduce realistic attack surface.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N positions this as a high-severity, network-exploitable flaw with low attack complexity requiring only subscriber-level authentication. The high C and I scores reflect the ability to read and tamper with other users' booking consent records in the shared WordPress database. An EPSS score of 16% is notably elevated - placing this vulnerability in approximately the top 10-15% of exploitation likelihood across all CVEs - and is likely driven by the existence of a publicly available POC (confirmed by WPScan). However, SSVC classifies exploitation as 'poc' and 'not automatable,' meaning mass automated attacks are not straightforward; exploitation likely requires targeted, manual effort. No CISA KEV listing means confirmed in-the-wild exploitation has not been formally established. The combination of subscriber-level auth requirement and non-automatability moderates the real-world risk compared to the raw CVSS score: sites that disable public registration or restrict subscriber capabilities face materially lower exposure.

An attacker self-registers a free subscriber account on a WordPress site running a vulnerable version of Events Manager, then submits a crafted HTTP request to the plugin's booking or consent endpoint, embedding SQL injection payloads in the vulnerable parameter. The injected SQL alters the WHERE clause or query structure to access or overwrite booking consent records belonging to other registered users - for example, forging consent on behalf of another attendee or extracting their personal booking data. A publicly available POC from WPScan further reduces the technical barrier for this attack.