CVE-2026-18057
Deferred Deferred - Pending Action

SQL Injection in Events Manager WordPress Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-26
Generated
2026-09-01
AI Q&A
2026-08-12
EPSS Evaluated
2026-08-31
NVD
CVE-2026-18057
EUVD
EUVD-2026-57097

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
events_manager events_manager to 7.4.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in the Events Manager WordPress plugin versions before 7.4.1. It occurs because user-controlled input is not properly sanitized or escaped before being used in SQL statements. This allows authenticated users with Subscriber-level access or higher to manipulate booking consent records belonging to other users through SQL injection.

Detection Guidance

Check the installed version of the Events Manager plugin. If it is below 7.4.1, the system is vulnerable. Use WordPress admin panel or run SQL query: SELECT * FROM wp_options WHERE option_name LIKE 'events_manager_version';

Monitor for unusual database queries or unauthorized changes to booking consent records by subscribers or higher-level users.

Impact Analysis

If you are a user with Subscriber-level access or higher on a vulnerable WordPress site using Events Manager before version 7.4.1, an attacker could tamper with booking consent records of other users. This could lead to unauthorized changes in consent statuses, potentially affecting data integrity within the plugin's booking records.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized modifications to consent records. Tampering with consent data may violate data integrity requirements, potentially leading to non-compliance with regulations that mandate accurate and unaltered user consent records.

Mitigation Strategies

Update the Events Manager plugin to version 7.4.1 or later immediately. Disable or restrict Subscriber-level access if not required. Review booking consent records for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18057. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart