Eventon Subscriber
Monthly
Unauthenticated SQL injection in the EventON - Subscriber WordPress plugin (all versions up to and including 1.4.5) allows remote attackers to append arbitrary SQL clauses to the plugin's existing database queries through the 'email' parameter, enabling extraction of sensitive data such as user credentials, password hashes, and other site secrets. The defect is a classic CWE-89 input-handling failure - the parameter is neither escaped nor bound via prepared statements - and scores 7.5 with high confidentiality impact but no integrity or availability effect, reflecting a read-only exfiltration path. No public exploit code or confirmed active exploitation was identified at time of analysis, although the unauthenticated network vector, low attack complexity, and absence of user interaction make the flaw an attractive target for automated scanning against any internet-facing site with the add-on active.
Unauthenticated SQL injection in the EventON - Subscriber WordPress plugin (all versions up to and including 1.4.5) allows remote attackers to append arbitrary SQL clauses to the plugin's existing database queries through the 'email' parameter, enabling extraction of sensitive data such as user credentials, password hashes, and other site secrets. The defect is a classic CWE-89 input-handling failure - the parameter is neither escaped nor bound via prepared statements - and scores 7.5 with high confidentiality impact but no integrity or availability effect, reflecting a read-only exfiltration path. No public exploit code or confirmed active exploitation was identified at time of analysis, although the unauthenticated network vector, low attack complexity, and absence of user interaction make the flaw an attractive target for automated scanning against any internet-facing site with the add-on active.