Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-18057

Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Events Manager

Default version status: unaffected

  • 0 to < 7.4.1affected

References