SQL Injection Vulnerability in Eventer Booking Manager Plugin for WordPress

CVE-2025-0959

What is CVE-2025-0959?

The Eventer - WordPress Event & Booking Manager Plugin contains a vulnerability that allows for SQL Injection through the 'reg_id' parameter in all versions up to and including 3.9.9.2. This flaw arises due to inadequate data escaping on user-supplied inputs, combined with insufficient preparation of the SQL query. As a result, authenticated users with Subscriber-level access or higher can insert malicious SQL queries into existing ones, potentially leading to the unauthorized extraction of sensitive data from the database.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References