CVE-2017-14760

Critical

Published: 27/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Event Espresso Lite plugin version 3.1.37.12.L for WordPress contains an SQL Injection vulnerability in the /includes/event-management/index.php file. The issue occurs via the recurrence_id parameter in requests to /wp-admin/admin.php.

Risk Assessment

An attacker could exploit this vulnerability to execute unauthorized queries against the database, potentially leading to the disclosure of sensitive information or data manipulation. This poses a serious threat to the integrity and confidentiality of data within the organization.

Recommendation

It is recommended to update the Event Espresso Lite plugin to the latest version that includes security fixes. Additionally, conducting a security audit of the application is advisable to identify and remediate other potential vulnerabilities.

Original NVD description (English source)

SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recurrence_id parameter to /wp-admin/admin.php.