EUVD-2026-40273
GHSA-7pfh-grwq-33x4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network SQLi (AV:N/PR:N) but AC:H because a non-default setting and a published event are required; primarily data extraction so C:H, limited I:L, A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versions up to, and including, 5.0.11 due to insufficient escaping on the user supplied parameter and lack of preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted the "Enable additional search queries" setting is enabled and at least one published event exists.
Articles & Coverage 2
AnalysisAI
Unauthenticated SQL injection in the EventON WordPress Virtual Event Calendar plugin (versions through 5.0.11) lets remote attackers inject arbitrary SQL through the 'search' parameter, enabling extraction of database contents such as user credentials and secrets. Exploitation is gated by the non-default 'Enable additional search queries' setting being enabled and the presence of at least one published event. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis.
Technical ContextAI
EventON is a commercial WordPress calendar/event-management plugin that exposes an event search feature backed by direct database queries. The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue: the user-supplied 'search' parameter is concatenated into an existing SQL statement without proper escaping and without using WordPress's prepared-statement API ($wpdb->prepare). The CPE 'cpe:2.3:a:eventon:eventon_(pro)_-_wordpress_virtual_event_calendar_plugin' identifies the affected component, and the description's reference to appending 'additional SQL queries into already existing queries' indicates the injection point allows query stacking/UNION-style data exfiltration against the WordPress MySQL/MariaDB backend.
RemediationAI
Upgrade EventON to a version later than 5.0.11 once released by the vendor; the input data does not include a specific fixed version, so no vendor-released patch version is independently confirmed at time of analysis - consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5a0c87-59b0-4da4-8949-0957f8e1b479?source=cve) and vendor site (https://www.myeventon.com/) for the patched release. As an immediate compensating control, disable the 'Enable additional search queries' setting, which removes the vulnerable code path entirely at the cost of losing the advanced search capability; this is the most direct and low-risk mitigation. Additionally, deploy a WordPress WAF (such as Wordfence) with SQL-injection rules to filter malicious 'search' parameter input, and restrict or rate-limit access to event search endpoints, accepting that WAF rules are signature-dependent and may not block all encodings.
The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field. Rated medium severity (CVSS 6
The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high pri
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX ac
The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax
The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action
The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high pri
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privil
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery i
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery i
Stored Cross-Site Scripting in the EventON WordPress plugin (versions ≤ 2.5.7) allows authenticated subscribers to injec
The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today