Description

Contributor SQL Injection in Event Tickets <= 5.29.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-30T13:17:38.943Z",
  "pubdate": "2026-09-30T13:17:38.943Z",
  "executiveSummary": "A SQL injection vulnerability exists in Event Tickets versions 5.29.5 and below, specifically impacting the Contributor user role.\nThe vulnerability allows an authenticated user with Contributor-level privileges to execute arbitrary SQL queries against the underlying database.\nThis flaw arises from improper sanitization of user-supplied input before it is incorporated into database queries, potentially leading to unauthorized data extraction, modification, or deletion.\nThe impact is significant, as it permits attackers to bypass application-level access controls and interact directly with the database, potentially compromising sensitive information or escalating privileges within the WordPress environment.\nExploitation requires the attacker to hold an account with at least Contributor permissions, limiting the attack surface to authenticated users rather than unauthenticated, remote attackers.\nRemediation requires upgrading the Event Tickets plugin to the latest patched version to ensure proper input validation and query parametrization are implemented.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located within the Event Tickets plugin, affecting all versions up to and including 5.29.5. The root cause is the improper handling of user-supplied data in database queries, where input is concatenated directly into SQL statements without adequate sanitization, escaping, or the use of prepared statements.\nThe vulnerability is specifically accessible to users with the Contributor role, which implies that the vulnerable component does not perform sufficient authorization checks or input validation at the application layer before executing database operations.\nThe attack flow proceeds as follows: An attacker authenticated as a Contributor submits a crafted request containing malicious SQL fragments to a vulnerable endpoint within the plugin. The application fails to validate the structure or content of these input parameters. Consequently, the input is passed directly to the database interaction layer, where it modifies the intended SQL query structure.\nBy manipulating the SQL syntax, the attacker can execute arbitrary SQL commands. This may include 'UNION-based' SQL injection to extract data from tables outside the scope of the original query, 'Boolean-based' or 'Time-based' blind SQL injection to infer database contents, or in some scenarios, data manipulation if the database user permissions are overly permissive.\nThe vulnerable component likely involves specific functions responsible for handling attendee management or event-related data queries where input from the dashboard interface is processed server-side. Because the WordPress `$wpdb` object might be used without proper parameter binding (e.g., using `$wpdb->prepare()`), the query execution flow is compromised.\nPost-exploitation impact includes unauthorized read access to the database (potentially compromising user credentials, personal data, or site configuration settings), the ability to perform 'Denial of Service' (DoS) by executing resource-intensive queries, or in certain configurations, potential privilege escalation if administrative account information is exfiltrated and subsequently leveraged."
}