SQL Injection Vulnerability in Eventer Booking Manager Plugin for WordPress
CVE-2025-0959

8.8HIGH

Key Information:

Vendor
Imithemes
Status
Eventer - WordPress Event & Booking Manager Plugin
Vendor
CVE Published:
7 March 2025

Summary

The Eventer - WordPress Event & Booking Manager Plugin contains a vulnerability that allows for SQL Injection through the 'reg_id' parameter in all versions up to and including 3.9.9.2. This flaw arises due to inadequate data escaping on user-supplied inputs, combined with insufficient preparation of the SQL query. As a result, authenticated users with Subscriber-level access or higher can insert malicious SQL queries into existing ones, potentially leading to the unauthorized extraction of sensitive data from the database.

Affected Version(s)

Eventer - WordPress Event & Booking Manager Plugin * <= 3.9.9.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://codecanyon.net/item/eventer-wordpress-event-manag...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
.