Description

The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec_records_edit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $_POST['standard'] and uses the JSON array keys directly as column identifiers in the SET clause of an UPDATE statement built inside RTEC_Db_Admin::update_entry(). Only esc_sql() (mysqli_real_escape_string) is applied to the identifier; that function escapes quotes, backslashes, and a few control characters but does not escape spaces, equals signs, parentheses, or hyphens, so an attacker can break out of the identifier context and inject subqueries (terminated with a SQL comment). This makes it possible for authenticated attackers, with Contributor-level access and above who can edit the targeted event, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-07-23T10:16:49.527Z",
  "pubdate": "2026-07-23T10:16:49.527Z",
  "executiveSummary": "The Registrations For The Events Calendar plugin for WordPress is vulnerable to an authenticated SQL Injection vulnerability affecting versions up to and including 3.2. The flaw exists within the AJAX action handler rtec_records_edit, which improperly handles JSON keys supplied through the 'standard' parameter. This vulnerability allows an authenticated attacker with Contributor-level access and above, who has permissions to edit the targeted event, to manipulate database queries via the RTEC_Db_Admin::update_entry() method.\nThe root cause stems from the application utilizing JSON array keys directly as SQL column identifiers within the SET clause of an UPDATE statement, applying only esc_sql() for sanitization. Because esc_sql() fails to escape critical characters such as spaces, equals signs, parentheses, and hyphens, an attacker can break out of the intended SQL identifier context. Successful exploitation enables malicious actors to append arbitrary SQL subqueries terminated with a SQL comment, facilitating the extraction of sensitive information from the underlying database. The risk implications include unauthorized data disclosure, database enumeration, and potential compromise of sensitive site data by privileged internal users.",
  "technicalDetails": "The vulnerability resides in the Registrations For The Events Calendar WordPress plugin, specifically within the AJAX action rtec_records_edit implemented in versions up to and including 3.2. The vulnerable component responsible for processing the input is the RTEC_Db_Admin::update_entry() method, which handles database update operations.\nThe attack vector involves sending a specially crafted HTTP request containing malicious input via the 'standard' parameter in a POST request. The AJAX handler decodes attacker-controlled JSON data directly from $_POST['standard'] and iterates over the JSON array keys, embedding them directly as column identifiers into the SET clause of a constructed SQL UPDATE statement.\nThe primary root cause is insufficient input validation and improper sanitization of database identifiers. The application applies only esc_sql() (which internally acts as mysqli_real_escape_string) to the JSON keys. While this function appropriately escapes quotes, backslashes, and specific control characters, it fails to neutralize SQL syntax delimiters and operators, including spaces, equals signs, parentheses, and hyphens.\nAn authenticated attacker possessing Contributor-level access or higher, combined with the capability to edit the targeted event, can exploit this behavior. By supplying manipulated JSON keys containing specific SQL syntax, the attacker breaks out of the intended column identifier context. The payload behavior allows the injection of arbitrary SQL subqueries directly into the existing UPDATE query structure. These injected payloads are typically terminated using a SQL comment character to ensure valid syntax and prevent subsequent native query clauses from causing syntax errors.\nThe post-exploitation impact includes the ability to perform error-based, boolean-based, or time-based blind SQL injection attacks to extract sensitive information stored within the WordPress database. Network exposure is restricted to authenticated users interacting with the WordPress AJAX endpoint, requiring specific baseline privilege levels and event-editing capabilities."
}