CVE-2017-7719

Critical

Published: 12/04/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Spider Event Calendar plugin before version 1.5.52 for WordPress has an SQL injection vulnerability that can be exploited via the order_by parameter in calendar_functions.php or widget_Theme_functions.php.

Risk Assessment

Exploitation of this vulnerability may lead to unauthorized access to the database, jeopardizing the integrity and confidentiality of the organization's data.

Recommendation

It is recommended to update the Spider Event Calendar plugin to the latest version to mitigate this vulnerability and conduct a security audit of the application.

Original NVD description (English source)

SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php.