EUVD-2026-42170
GHSA-cq7c-w54c-w89p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable 'code' parameter (AV:N/AC:L/PR:N/UI:N) yields blind data extraction, so C:H with no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the Eventer WordPress event manager plugin (all versions through 4.4.2) lets unauthenticated attackers inject arbitrary SQL through the 'code' parameter, extracting database contents such as user credentials and session data. The flaw stems from unescaped user input concatenated into an existing query, exploitable remotely without authentication (PR:N). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 7.5 reflects confidentiality-only impact via time-based blind extraction.
Technical ContextAI
Eventer is a commercially distributed WordPress plugin (sold on CodeCanyon as 'Eventer - WordPress Event Manager') by author joe007, per CPE cpe:2.3:a:joe007:eventer. The vulnerability is a classic CWE-89 SQL Injection: the 'code' request parameter is placed into a SQL statement without proper escaping and without using WordPress's prepared-statement API ($wpdb->prepare()), allowing an attacker to break out of the intended query context. Because the injection is time-based (blind), the attacker infers data by measuring conditional response delays (e.g., via SLEEP()) rather than reading results directly in the response, which makes exfiltration slower but fully feasible with automated tooling.
RemediationAI
No fixed version is identified in the provided data, so no exact patch release can be cited; monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3b0a3a-ce4b-40fd-9519-a81e315cee42) and the CodeCanyon product page for an update beyond 4.4.2 and apply it as soon as it is published. As compensating controls until a patch is confirmed, deploy a WAF rule (e.g., Wordfence firewall) to block SQL metacharacters and time-based payloads on the 'code' parameter for Eventer endpoints; restrict or disable the vulnerable event-code functionality if it is not business-critical, accepting the loss of that feature; and monitor database query logs for anomalous SLEEP()/BENCHMARK() patterns and unusually slow requests indicative of blind extraction. Because the injection is unauthenticated, IP allowlisting is not viable for public event pages, so WAF filtering is the primary interim defense.
Account takeover in the Eventer WordPress event-manager plugin (all versions through 4.4.2) stems from the plugin writin
The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_i
The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '
The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_attendees'
The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via th
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today