Events Manager CVE-2026-42633

Requires an authenticated WordPress account at the Subscriber level (the lowest registered-user role) on a site with Events Manager <= 7.4.6 installed and active (CVSS PR:L confirms authentication is needed). For an otherwise external attacker, exploitation depends on the target site permitting open user self-registration to obtain that Subscriber account; sites that disable registration substantially raise the barrier. No end-user interaction is required (UI:N) and the flaw is reachable over the network (AV:N), but the authenticated-Subscriber requirement is the key limiting factor that prevents fully unauthenticated mass exploitation.

This is a credible, actionable priority rather than an inflated high-CVSS score. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) describes a network-reachable, low-complexity SQL injection (CWE-89) requiring only low privileges - consistent with the description's 'Subscriber' qualifier, meaning the lowest-tier authenticated WordPress role can exploit it. The scope change (S:C) and C:H reflect that injected SQL reaches the backend database as a separate component, enabling disclosure of data beyond the plugin's own boundary (e.g. wp_users hashes, secrets). No EPSS score, CISA KEV entry, or public POC was provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis. The realistic risk driver is the low barrier: on any site allowing open user registration, an attacker can self-provision a Subscriber account and exploit remotely. Note the authenticated prerequisite (PR:L) meaningfully limits mass, unauthenticated internet-wide exploitation compared with a PR:N flaw - verify whether the vulnerable site permits self-registration.

An attacker registers (or already holds) a low-privilege Subscriber account on a WordPress site running Events Manager <= 7.4.6, then submits a crafted request to a vulnerable plugin endpoint with malicious SQL in a parameter. The injection executes against the WordPress database, letting the attacker extract sensitive data such as user password hashes and session/secret material. Low attack complexity (AC:L) and no required user interaction (UI:N) make the attack reliable once an account is obtained; no public exploit code was identified in the provided data.