The Events Calendar CVE-2026-49772

The vulnerable site must be running WordPress with The Events Calendar plugin installed and active at versions 6.15.12 through 6.16.2, with the vulnerable endpoint reachable by the attacker (default WordPress configuration exposes both /wp-admin/admin-ajax.php and the /wp-json REST API to unauthenticated clients). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special configuration is required beyond having the plugin enabled. Practical limits: exploitation is blind, so it requires repeated automated requests that are noisy and may be blocked by a WAF, rate limiter, or fail2ban-style WordPress hardening; the specific affected endpoint and parameter are not disclosed in the provided data and must be confirmed against the Patchstack advisory.

Signals are mixed: the CVSS 3.1 base score of 9.3 with AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L paints this as critical and trivially reachable, and the scope change plus C:H reflects that a single SQL injection in a WordPress plugin can expose data well beyond the plugin's own tables (user password hashes, session tokens in wp_users / wp_usermeta, wp_options secrets). On the other hand, the vulnerability is blind (slower to exploit, often requires automation such as sqlmap), no public PoC, KEV listing, or EPSS score was provided in the input, and only a Patchstack reference is supplied - so weaponisation is plausible but not confirmed. The CVSS author's choice of I:N and A:L (rather than I:H/A:H) suggests the injection point may not permit stacked/UNION writes, which is consistent with blind read-only SQLi but should be verified with the Patchstack advisory. Given the install base of this plugin and the well-known ease of mass-scanning WordPress endpoints, this should be treated as a high-priority patch even without exploitation telemetry.

An unauthenticated remote attacker scans WordPress sites for The Events Calendar 6.15.12-6.16.2 by fingerprinting plugin assets, then sends crafted requests (likely time-based payloads via sqlmap) to the vulnerable AJAX or REST endpoint to blind-extract data such as administrator password hashes from wp_users and secret_keys from wp_options. With those hashes the attacker can attempt offline cracking or use leaked session/auth cookies to escalate to full WordPress admin and deploy a webshell. No public exploit identified at time of analysis, but blind SQLi in popular WordPress plugins is historically automated within days of disclosure.