What is the CVSS score of CVE-2026-49772?

CVE-2026-49772 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of The Events Calendar are affected by CVE-2026-49772?

The Events Calendar WordPress plugin (versions 6.15.12-6.16.2) contains a critical blind SQL injection vulnerability allowing unauthenticated remote attackers to extract sensitive database…

How to fix or mitigate CVE-2026-49772?

24 hours: Inventory all WordPress sites running The Events Calendar and identify those on versions 6.15.12-6.16.2; implement temporary WAF rules to detect SQL injection payloads. 7 days: Downgrade affected sites to The Events Calendar version 6.15.11 or earlier, or disable the plugin entirely if not critical to operations; test thoroughly in staging. 30 days: Monitor vendor advisories for patch release; when available, thoroughly test in non-production environment before deploying to production sites.

The Events Calendar CVE-2026-49772

EUVD-2026-37057 CRITICAL

SQL Injection (CWE-89)

2026-06-16 Patchstack

GHSA-v796-wqfq-j4xh

SQLi The Events Calendar

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Plugin endpoint is internet-reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N); blind SQLi reads cross-table data (S:C, C:H) but the input implies no write/DoS primitive (I:N, A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 10:26 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection.

This issue affects The Events Calendar: from 6.15.12 through 6.16.2.

AnalysisAI

Blind SQL injection in The Events Calendar WordPress plugin (versions 6.15.12 through 6.16.2) by Liquid Web / StellarWP allows remote attackers to inject malicious SQL via unsanitized input handled by the plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates a network-reachable, unauthenticated, low-complexity issue with a scope change and high confidentiality impact, putting it at 9.3 critical. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided in the input.

Technical ContextAI

The Events Calendar is a widely deployed WordPress plugin (over 800k active installations historically) maintained by StellarWP/Liquid Web that adds event management, calendars, and ticketing endpoints to WordPress sites. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input is concatenated into a SQL query executed against the underlying WordPress MySQL/MariaDB database (the wp_* schema) without using $wpdb->prepare() with proper placeholders or sufficient sanitisation. Because exploitation is blind, the attacker does not get query results in the HTTP response and instead infers data via boolean or time-based side channels, typically against publicly reachable plugin AJAX or REST handlers exposed by WordPress.

RemediationAI

Upgrade The Events Calendar to a version newer than 6.16.2 as published on wordpress.org or via the WordPress plugin updater - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-15-12-6-16-2-sql-injection-vulnerability is the authoritative reference for the fixed release. If immediate patching is not possible, deploy a virtual patch via a WordPress WAF such as Patchstack, Wordfence, or a cloud WAF with SQLi rule sets, and restrict access to the affected plugin endpoints (typically /wp-admin/admin-ajax.php actions and /wp-json/tribe/* REST routes) from untrusted networks - note this can break legitimate front-end calendar features for public visitors. As a deeper compensating control, enforce least-privilege on the WordPress database user (no FILE, no DROP/ALTER on non-plugin tables) to limit lateral damage, and rotate any secrets stored in wp_options or auth keys in wp-config.php if exploitation is suspected.