CVE Intelligence
Analysis AI-assisted

CVE-2026-9711: EventON Calendar Plugin for WordPress: SQL Injection via search parameter

CVE-2026-9711 is a critical SQL Injection flaw (CWE-89) in the EventON virtual event calendar plugin for WordPress, affecting versions up to and including 5.0.11. The record states that an unauthenticated attacker can reach the database through the WordPress 'search' parameter when the 'Enable additional search queries' setting is on and at least one published event exists. The record reports no confirmed exploitation and no KEV listing, and it does not provide a fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

EventON is a virtual event calendar plugin for WordPress. Wordfence, the CNA for this record, reports an SQL Injection flaw (CWE-89) involving the WordPress 'search' parameter. The record says user-supplied input is insufficiently escaped and the existing SQL query is not prepared. Sources: NVD record and Wordfence threat intelligence entry.

Impact

The description states that the flaw can be used to extract sensitive information from the database. The CVSS 3.1 vector reported by Wordfence (base score 9.8, critical) marks high impact on confidentiality, integrity and availability.

  • The record describes exposure of database contents, which is the main confirmed impact.
  • Integrity and availability impact follow from the reported vector. The description does not detail them, so the practical scope is an inference.

Affected products and versions

  • Product: EventON - WordPress Virtual Event Calendar Plugin (WordPress, full version).
  • Affected range: versions up to and including 5.0.11, as stated in the description.
  • Required conditions: the 'Enable additional search queries' setting must be enabled, and at least one published event must exist.
  • The record's affected and fixes lists are empty, so no fixed version is confirmed. Vendor information is available at myeventon.com.

Exploitation status

The record marks the CVE as not listed in CISA KEV. No confirmed active exploitation appears in the sources consulted, so this analysis does not state that the flaw is exploited in the wild. The EPSS probability is 0.0054 (about 0.54%) with a percentile of 0.43911, which is an estimate of exploitation likelihood and not evidence of exploitation.

Remediation and mitigation

  • Check the vendor site and update EventON to a release confirmed by the vendor to fix this issue. The record does not provide a fixed version.
  • Releases newer than 5.0.11 fall outside the stated affected range, but the record does not confirm that they contain the fix. Verify before relying on this.
  • Until patched, if the additional search queries feature is not required, disabling the 'Enable additional search queries' setting is likely to reduce exposure, since the record makes it a precondition. Confirm the effect with the vendor.
  • Limit public exposure of WordPress sites running affected versions, keep verified backups, and use a database account with the least privileges the site needs.
  • Apply web application firewall rules from your provider where available, and treat them as a temporary control rather than a fix.

Detection guidance

  • Review web server and application access logs for requests to search endpoints with unusually long values or unexpected special characters in the search parameter.
  • Look for database errors or slow queries tied to search requests, which can indicate probing.
  • Monitor for unexpected changes in site content, administrative accounts or database records.
  • The record does not include indicators of compromise, so detection relies on general anomaly review.

Limitations of the available information

  • No fixed version, patch reference or vendor advisory is included in the record.
  • The affected and fixes lists are empty, so product coverage beyond the description is unknown.
  • The record's source status is Deferred, and the NVD and CVE.org pages were not reviewed beyond their identifiers.
  • The CVSS data comes from the CNA (Wordfence) only.
  • The record's dates are not fully consistent with each other, so timing should be confirmed against the source pages.

Frequently asked questions

Which EventON versions are affected by CVE-2026-9711?

The description states that versions up to and including 5.0.11 are affected. The record does not list a fixed version, so check the vendor site for confirmed fixed releases.

Does an attacker need to log in to exploit this flaw?

The description says unauthenticated attackers can exploit it, but only when the 'Enable additional search queries' setting is enabled and at least one published event exists.

Is this CVE known to be exploited in the wild?

The record shows the CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. EPSS gives a low estimated exploitation probability.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.