SQL Injection Vulnerability in Eventer Plugin for WordPress

CVE-2024-11135

What is CVE-2024-11135?

The Eventer plugin for WordPress is susceptible to an SQL Injection vulnerability due to inadequate escaping of the 'event' parameter in the 'eventer_get_attendees' function. This weakness affects all versions up to and including 3.9.8. Attackers without authentication can exploit this flaw to inject malicious SQL queries, potentially retrieving sensitive information from the database. This underscores the importance of robust input validation and query preparation to safeguard against unauthorized database access.

References