EventON EUVD-2026-40273

Exploitation requires that the EventON plugin's 'Enable additional search queries' setting be enabled (a non-default configuration toggle) AND that at least one published event exist on the site; both conditions are explicitly stated in the advisory. The injection is delivered through the WordPress 'search' parameter over the network. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N), so any unauthenticated remote attacker can exploit a qualifying instance. The limiting factors are therefore configuration-based rather than access-based: sites without the additional-search-queries feature enabled, or with no published events, are not exploitable, which constrains the real-world attack surface despite the network-unauthenticated vector.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) reflects a network-reachable, low-complexity, unauthenticated path with high impact across confidentiality, integrity, and availability - characteristic of an unauthenticated SQLi. However, the raw score overstates real-world exposure because exploitation is explicitly conditional: the 'Enable additional search queries' setting must be enabled (a non-default toggle) and at least one published event must exist. This materially reduces the population of exploitable instances relative to total installs, arguing for AC:H in a more honest assessment. No EPSS score, SSVC decision, or KEV listing was provided, and no public PoC was identified, so there is no current evidence of active or automated exploitation; the realistic priority is high for sites known to run the affected versions with the feature enabled, and moderate elsewhere. The C:H/I:H/A:H rating is somewhat generous for a primarily read-oriented extraction flaw - integrity/availability impact would depend on stacked write queries actually being executable.

An attacker discovers a public WordPress site running EventON ≤5.0.11 with additional search queries enabled and at least one published event, then sends a crafted HTTP request supplying a malicious SQL payload in the 'search' parameter. Because the input is concatenated into the query without escaping or preparation, the appended SQL executes and returns database contents - for example dumping wp_users password hashes and secret keys - without any authentication. No public PoC is currently identified, but the low attack complexity makes weaponization straightforward.