Events Manager EUVD-2026-65194

Exploitation requires a valid WordPress user account with at minimum contributor-level role permissions, which is needed to add custom meta keys to events or locations via the WordPress post meta interface. The attacker must have access to the event_duplicate or location_duplicate action as exposed through em-actions.php (L160 and L316); these actions are available to contributors on the Events Manager plugin's standard flows. The attack is strictly two-phase: the attacker must first write a malicious meta key to wp_postmeta through the add-meta flow, and then a duplication action must be performed on the affected event or location - either by the attacker themselves or by a higher-privileged user who duplicates the poisoned content. Exploitation is bounded to installations running Events Manager plugin version 7.4.0 or below; no special server configuration, database permissions, or network positioning beyond HTTP access to the WordPress admin is required. The two-factor nature of the attack - planting then detonating - means the payload may persist in wp_postmeta and be triggered later by legitimate admin activity, even after the attacker's account is removed.

The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is well-calibrated for this vulnerability. The network attack vector and low complexity are accurate: once the attacker holds a contributor account, both the storage and detonation steps are straightforward HTTP interactions with the WordPress admin. PR:L correctly represents the contributor-level authentication requirement, which is the primary limiting factor for opportunistic exploitation. The high confidentiality impact reflects that the full WordPress database is readable - including user hashes, private content, API keys stored in wp_options, and multi-tenant data in shared environments. No EPSS score was provided in the input data, so exploitation probability cannot be quantified; no CISA KEV listing is present, confirming no confirmed active exploitation at time of analysis. The second-order attack pattern adds operational lift (two steps, actor must hold an account) compared to a direct injection, which practically lowers real-world risk relative to unauthenticated SQLi. The primary threat model is insider abuse, compromised contributor accounts, or sites that permit open user registration at contributor level. The public Trac source links expose exact vulnerable line numbers, meaning any researcher can reconstruct a working exploit without a disclosed POC - this is a meaningful risk amplifier that is not captured in the CVSS score.

An attacker registers or compromises a contributor-level WordPress account on a site running Events Manager 7.4.0 or earlier, then navigates to an event's custom fields and submits a meta key containing a UNION-based SQL payload (e.g., foo` UNION SELECT user_pass,user_login FROM wp_users-- -). WordPress stores this string verbatim in wp_postmeta. When the attacker subsequently clicks 'Duplicate Event' - or when any editor or administrator triggers the duplication - em-event.php reads the stored meta key and concatenates it into an INSERT query, causing the injected UNION clause to execute and return WordPress user password hashes or other database contents. No public exploit code has been confirmed, but the exact vulnerable lines are publicly referenceable via Trac.