CVE-2026-15023
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The Events Manager plugin for WordPress up to version 7.4.0 is vulnerable to SQL injection via the 'meta_key' parameter in the event/location duplicate action. Attackers with contributor-level access can append additional SQL queries to extract sensitive information from the database.
Risk Assessment
This vulnerability allows unauthorized access to database data, potentially leading to data breaches and system integrity compromise.
Recommendation
Update the Events Manager plugin to the latest version. Restrict access to the duplicate action for lower-privileged users.
Other vulnerabilities in Events Manager
See all- CVE-2026-18366Critical
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the plugin's own posts.
- CVE-2026-17089Medium
The Events Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parameter in versions up to and including 7.4.0.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link.
- CVE-2026-14280Medium
The Events Manager plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 7.3.7.4 via the em_options_save function. Authenticated attackers with administrator-level access can include and execute arbitrary .php files on the server, leading to code execution or data exposure.
- CVE-2026-10627Medium
The Events Manager plugin for WordPress is vulnerable to authorization bypass in versions up to and including 7.4.0. Unauthenticated attackers can view titles, dates, descriptions, and location details of events and locations marked as draft, pending, trashed, or private.
- CVE-2026-18057High
The Events Manager WordPress plugin before 7.4.1 does not sanitize and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.
- CVE-2026-66457High
Unauthenticated Cross Site Scripting (XSS) in Events Manager versions up to 7.4.1.
- CVE-2026-12987High
The Events Manager WordPress plugin before version 7.3.7 unsafely handles booking-registration data on sites using No-User-Account Booking Mode. A booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query built without parameterization, so an unauthenticated attacker can read arbitrary database data (e.g., user password hashes, secret keys) when the booking is later loaded.
- CVE-2026-57713High
The Events Manager WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This issue affects all versions up to and including 7.3.6.
Original NVD description (English source)
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta_key' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an attacker first plants SQL metacharacters in a custom meta key via the standard add-meta flow (WordPress stores these verbatim in wp_postmeta), then triggers the injection by invoking the event_duplicate or location_duplicate action, which reads the stored meta keys via get_post_meta() and concatenates them unsafely into the INSERT query.