CVE-2025-10587: Jackdewey Community Events up to 1.5.1 - SQL Injection
The Community Events plugin for WordPress contains an SQL injection flaw in the event_category parameter in all versions up to and including 1.5.1, according to the record. The record describes access by Subscriber-level users and above, while its title suggests no authentication is needed, so the required privilege level is not clear from the available data. Wordfence records a CVSS 3.1 base score of 9.8, no CISA KEV listing and no confirmed exploitation in the sources consulted.
Overview The Community Events plugin for WordPress, associated with Jackdewey, has an SQL injection weakness (CWE-89) in the event_category parameter. The record places it in all versions up to and including 1.5.1. The vulnerability was published by Wordfence as a CNA on 2025-10-08. ## Impact According to the description, a successful attacker could append SQL queries to existing queries and extract sensitive information from the site database. The record assigns a CVSS 3.1 base score of 9.8 (critical), with high impact on confidentiality, integrity and availability. The SSVC record rates technical impact as total. ## Affected products and versions - Jackdewey Community Events, all versions up to and including 1.5.1 according to the record. - The record lists no fixed version, so the existence and version of a fix are unknown from this data. ## Exploitation status The CVE is not listed in CISA KEV. No confirmed exploitation in the wild appears in the sources consulted. The SSVC record lists exploitation as none and automatable as yes, which describes the assessed ease of automation and does not confirm attacks. ## Remediation and mitigation - Check the plugin page on WordPress.org and the Wordfence advisory for a release newer than 1.5.1, and update as soon as one is confirmed. - If no fixed version is available, consider deactivating or removing the plugin until a vendor fix is verified. - Review which accounts exist on the site, especially low-privilege accounts, and remove unneeded ones. - Limit exposure of the plugin's public endpoints where operationally feasible, and keep WordPress core and other plugins updated. ## Detection guidance - Review web server and application logs for unusual values in the event_category parameter on pages that use the plugin. - Watch for database errors or abnormal query volume associated with the plugin's pages. - Consider web application firewall monitoring for SQL-related anomalies on these requests, tuned to avoid false positives. ## Limitations of the available information - The title describes the flaw as unauthenticated, while the description requires Subscriber-level access or above. The CVSS vector records PR:N. The exact privilege requirement is unknown. - The record contains no fixed version and no patch reference. - The record source status is listed as Deferred. - The EPSS date in the record (2026-10-13) is later than the publication date; treat the EPSS values with caution.
Frequently asked questions
Does this CVE affect the Community Events plugin on my WordPress site?
The record says all versions up to and including 1.5.1 are affected. Check the installed plugin version and update or remove it if it is at or below that version.
Is this vulnerability being actively exploited?
CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. Continue monitoring rather than assuming it is safe.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.