SQL Injection Vulnerability in Eventer Booking Manager Plugin for WordPress

CVE-2025-0959

Summary

The Eventer - WordPress Event & Booking Manager Plugin contains a vulnerability that allows for SQL Injection through the 'reg_id' parameter in all versions up to and including 3.9.9.2. This flaw arises due to inadequate data escaping on user-supplied inputs, combined with insufficient preparation of the SQL query. As a result, authenticated users with Subscriber-level access or higher can insert malicious SQL queries into existing ones, potentially leading to the unauthorized extraction of sensitive data from the database.

References