Events Made Easy < 2.2.36 - Subscriber+ SQL Injection
CVE-2021-25030

8.8HIGH

Key Information:

Vendor

Wordpress
Status
Events Made Easy
Vendor
CVE Published:
3 January 2022

What is CVE-2021-25030?

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks

Affected Version(s)

Events Made Easy 2.2.36

References

https://wpscan.com/vulnerability/bc7058b1-ca93-4c45-9ced-...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof ZajÄ…c
.