WP Events Manager Plugin Vulnerable to SQL Injection

CVE-2024-7717

Summary

The WP Events Manager plugin in WordPress contains a vulnerability that allows authenticated attackers with Subscriber-level access and above to perform time-based SQL injection through the 'order' parameter. The lack of adequate escaping on user-supplied input and improper preparation of SQL queries enables attackers to append malicious SQL queries to existing ones. This exploitation could lead to unauthorized data access, highlighting the necessity for timely updates and security practices.

References