EventON Subscriber EUVD-2026-104799

No special conditions beyond the plugin being installed and reachable - the injection is in the 'email' parameter of the EventON - Subscriber plugin and is exploitable by unauthenticated remote attackers (AV:N/PR:N/UI:N) against affected installations up to and including version 1.4.5. The limiting factors are deployment-specific: the target site must have the EventON - Subscriber add-on active and the vulnerable endpoint internet-accessible, and only versions ≤1.4.5 are affected (updating past 1.4.5 removes exposure). Impact is confined to confidentiality (database read/exfiltration); no data modification or denial of service is indicated by the CVSS vector.

This is a genuinely prioritizable flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated SQL injection with no user interaction, which aligns cleanly with the description's claim of exploitation by 'unauthenticated attackers' via the 'email' parameter. The 7.5 base score is driven entirely by confidentiality (C:H), with I:N/A:N, consistent with a data-exfiltration-only generic/UNION-style injection rather than one enabling write or RCE. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk here is latent exploitability, not confirmed in-the-wild use. The absence of an SSVC decision and EPSS means automatability and real-world exploitation likelihood cannot be quantified from the data given. Net: a credible, easy-to-exploit unauthenticated information-disclosure bug on any exposed site running the affected plugin, warranting prompt patching, but currently without signals (KEV/EPSS/POC) that would escalate it to emergency status.

An unauthenticated attacker sends an HTTP request to a WordPress site running EventON - Subscriber (≤1.4.5) with a crafted value in the 'email' parameter that breaks out of the existing, insufficiently prepared SQL query. Because the input is neither escaped nor parameterized, the appended SQL executes and the attacker reads sensitive data (e.g., user records, password hashes, secrets) from the database. No public exploit was identified in the provided data, but low complexity and no authentication make weaponization straightforward.