CVE-2026-15023: Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an attacker first plants SQL metacharacters in a custom meta key via the standard add-meta flow (WordPress stores these verbatim in wppostmeta), then triggers the injection by invoking the eventduplicate or locationduplicate action, which reads the stored meta keys via getpostmeta() and concatenates them unsafely into the INSERT query.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level permissions or higher. They must be able to add a custom meta key and then invoke an event or location duplicate action.
Does exploitation require a separate initial step?
Yes. This is a second-order SQL injection: the attacker first stores SQL metacharacters in a custom meta key through the standard add-meta flow, then triggers duplication of an event or location so the stored key is incorporated unsafely into an SQL query.
What is the likely impact if exploitation succeeds?
The injected SQL can be used to extract sensitive information from the WordPress database. The provided severity vector indicates confidentiality impact, with no stated integrity or availability impact.
How can I look for signs of exposure?
Review custom post-meta keys associated with Events Manager event or location records, particularly keys containing SQL metacharacters or otherwise unusual values. Also review use of the event_duplicate and location_duplicate actions following creation or modification of custom metadata.