Event Tickets CVE-2026-97287

Exploitation requires an authenticated WordPress account with at least Contributor role (PR:L) on a site running Event Tickets version 5.29.5 or earlier; the attack is remote over the network (AV:N), low complexity (AC:L), and needs no user interaction (UI:N). The limiting factor is the Contributor authentication requirement - realistic on sites permitting open user registration or with many low-trust contributors, but it blocks fully unauthenticated mass exploitation. No specific non-default plugin configuration is indicated by the advisory beyond having the affected plugin installed and active.

This is a genuine mid-to-high priority issue but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) describes a network-reachable, low-complexity SQL injection requiring only Contributor-level privileges (PR:L) and no user interaction. The elevated score is driven largely by the scope change (S:C): because a WordPress plugin queries the shared site database, injected SQL reaches data belonging to the whole WordPress instance, not just the plugin. Confidentiality impact is High (database read/exfiltration) while integrity is None and availability is Low. Exploitation signals are otherwise quiet: there is no CISA KEV listing, no EPSS score provided, and no public POC referenced - so this is 'no public exploit identified at time of analysis' rather than confirmed exploitation. The real-world gating factor is the PR:L requirement: an attacker needs a valid Contributor account, which limits blind mass exploitation but is realistic on sites with open registration or many low-trust authors. Net: a real, patch-worthy authenticated SQLi in a widely deployed plugin, but the authentication prerequisite and absence of active-exploitation signals keep it below drop-everything urgency.

An attacker registers or obtains a WordPress Contributor account on a site running Event Tickets <= 5.29.5, then submits a crafted request to a vulnerable plugin endpoint whose parameter is concatenated into a SQL query. Because the plugin shares the WordPress database (scope change), the injected query lets the attacker read arbitrary tables - including wp_users password hashes and secret keys. No public exploit code is currently identified, but the low attack complexity makes weaponization straightforward once the injectable parameter is known.