Description

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T06:19:34.757Z",
  "pubdate": "2026-08-12T06:19:34.757Z",
  "executiveSummary": "A SQL injection vulnerability exists in the Events Manager WordPress plugin prior to version 7.4.1. The flaw stems from insufficient sanitization and escaping of user-controlled input prior to its inclusion in a SQL statement.\nThe vulnerability allows authenticated users holding a subscriber account or higher to execute arbitrary SQL commands against the underlying database. This capability enables malicious actors to tamper with booking consent records belonging to other users, potentially leading to unauthorized data modification and integrity compromise.\nExploitation requires authenticated access with minimal privileges (subscriber level) and network access to the target WordPress instance. The risk implication is significant as it breaks authorization boundaries within the database interaction layer, allowing low-privileged accounts to manipulate sensitive transactional data.\nAffected systems include any WordPress installation running the Events Manager plugin in versions prior to 7.4.1. Mitigation requires updating the plugin to version 7.4.1 or later where proper input sanitization and parameterization are implemented.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper neutralization of special elements used in an SQL command, classifying it as a classic SQL injection flaw. Specifically, the Events Manager plugin fails to adequately sanitize and escape a user-controlled parameter before concatenating or directly embedding it into a database query string.\nThe vulnerable component is the database interaction handling within the Events Manager WordPress plugin for versions before 7.4.1. Authentication and privilege requirements mandate that the attacker holds at least a subscriber-level account on the target WordPress site, granting access to specific plugin functionalities exposed to low-privileged authenticated users.\nThe attack flow proceeds as follows: 1) An attacker authenticates to the WordPress platform using a subscriber-grade account. 2) The attacker crafts an HTTP request targeting functionality within the Events Manager plugin that processes user-supplied parameters intended for database operations. 3) The application accepts the unescaped user-controlled input and dynamically incorporates it directly into the execution path of an SQL statement without utilizing prepared statements or parameterized queries. 4) The database engine parses and executes the injected SQL payload alongside the original query structure.\nThe payload behavior allows the attacker to manipulate the logic of the underlying database query. In the context of this vulnerability, the impact is specifically demonstrated through the ability to tamper with booking consent records belonging to other users. Depending on the exact query context and database permissions, post-exploitation impact could extend to broader data exposure or modification, circumventing application-level access controls via direct database manipulation."
}