Eventer CVE-2026-9700

Exploitation requires only that the Eventer plugin (version ≤ 4.4.2) is installed and its event-'code' handling endpoint is reachable over the network - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and no special privileges are needed against a default plugin installation. The concrete prerequisite is a request reaching the code path that consumes the 'code' parameter; the practical limiting factor is that the technique is time-based blind SQL injection, so exfiltration is slower and noisier than in-band SQLi and depends on reasonably stable server response timing. Impact is confidentiality-only (C:H/I:N/A:N), so this alone does not permit data modification or denial of service.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms genuinely low-friction exploitation: network-reachable, low complexity, no privileges, no user interaction - the hallmark of an internet-facing, automatable WordPress attack surface. Impact is scoped to confidentiality only (C:H/I:N/A:N), consistent with a data-extraction SQLi rather than RCE or defacement. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so real-world exploitation velocity cannot be quantified from the input; however, unauthenticated SQLi in commercial WordPress plugins is a well-established target for opportunistic mass scanning, so the absence of a published POC should not be read as low risk. This is a real priority for any site running the plugin, though the confidentiality-only scope means it is a data-breach risk rather than a full site-takeover primitive on its own.

An attacker discovers a WordPress site running the Eventer plugin and sends a crafted request supplying a time-based SQL payload in the 'code' parameter (e.g., a conditional SLEEP()). By observing response timing across many automated requests, the attacker blindly extracts administrator password hashes and other sensitive rows from the WordPress database. No authentication or user interaction is required, so the attack can be scripted and run at scale against many sites; no public POC is identified at time of analysis.