CVE-2026-18057
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Events Manager WordPress plugin before 7.4.1 does not sanitize and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.
Risk Assessment
An authenticated user can access or modify other people's data, potentially violating privacy and data integrity.
Recommendation
Update the Events Manager plugin to version 7.4.1 or later. Ensure all parameters are properly sanitized and escaped.
Original NVD description (English source)
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.