What is the CVSS score of EUVD-2026-42170?

EUVD-2026-42170 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Eventer are affected by EUVD-2026-42170?

The Eventer WordPress event management plugin (all versions through 4.4.2) is vulnerable to unauthenticated SQL injection that allows attackers to remotely extract sensitive database contents…

How to fix or mitigate EUVD-2026-42170?

Within 24 hours: Inventory all WordPress installations for the Eventer plugin and document current versions in use. Within 7 days: Deactivate the Eventer plugin on all systems or implement WAF rules to block SQL injection payloads targeting the 'code' parameter; document remediation status. Within 30 days: Monitor vendor advisories for patch availability; evaluate alternative event management plugins or plan phased upgrade strategy when patch releases; audit all affected database access logs for signs of exploitation.

Eventer EUVD-2026-42170

| CVE-2026-9700 HIGH

SQL Injection (CWE-89)

2026-07-08 Wordfence

GHSA-cq7c-w54c-w89p

WordPress SQLi Eventer

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable 'code' parameter (AV:N/AC:L/PR:N/UI:N) yields blind data extraction, so C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 06:21 vuln.today

CVE Published

Jul 08, 2026 - 05:34 nvd

HIGH 7.5

DescriptionCVE.org

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in the Eventer WordPress event manager plugin (all versions through 4.4.2) lets unauthenticated attackers inject arbitrary SQL through the 'code' parameter, extracting database contents such as user credentials and session data. The flaw stems from unescaped user input concatenated into an existing query, exploitable remotely without authentication (PR:N). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 7.5 reflects confidentiality-only impact via time-based blind extraction.

Technical ContextAI

Eventer is a commercially distributed WordPress plugin (sold on CodeCanyon as 'Eventer - WordPress Event Manager') by author joe007, per CPE cpe:2.3:a:joe007:eventer. The vulnerability is a classic CWE-89 SQL Injection: the 'code' request parameter is placed into a SQL statement without proper escaping and without using WordPress's prepared-statement API ($wpdb->prepare()), allowing an attacker to break out of the intended query context. Because the injection is time-based (blind), the attacker infers data by measuring conditional response delays (e.g., via SLEEP()) rather than reading results directly in the response, which makes exfiltration slower but fully feasible with automated tooling.

RemediationAI

No fixed version is identified in the provided data, so no exact patch release can be cited; monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3b0a3a-ce4b-40fd-9519-a81e315cee42) and the CodeCanyon product page for an update beyond 4.4.2 and apply it as soon as it is published. As compensating controls until a patch is confirmed, deploy a WAF rule (e.g., Wordfence firewall) to block SQL metacharacters and time-based payloads on the 'code' parameter for Eventer endpoints; restrict or disable the vulnerable event-code functionality if it is not business-critical, accepting the loss of that feature; and monitor database query logs for anomalous SLEEP()/BENCHMARK() patterns and unusually slow requests indicative of blind extraction. Because the injection is unauthenticated, IP allowlisting is not viable for public event pages, so WAF filtering is the primary interim defense.