CVE-2026-42633: WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability

Q: What access does an attacker need to exploit this issue?

The vulnerability is described as subscriber SQL injection, so an attacker needs Subscriber-level access to a WordPress site using the affected plugin.

Q: Is this exploitable remotely without user interaction?

The vector is network-based and requires no user interaction. However, the attacker must first have the required low-privileged Subscriber account access.

Q: What security impact could successful exploitation have?

The provided CVSS vector indicates high confidentiality impact, no integrity impact, and low availability impact. The scope is changed, meaning the impact may extend beyond the vulnerable plugin's original security authority.

Q: Which plugin versions are affected?

WordPress Events Manager versions 7.4.6 and earlier are identified as affected.

Published Oct 10, 2026

Updated

Subscriber SQL Injection in Events Manager <= 7.4.6 versions.

Affected Software

1 affected component

WordPress Events Manager<=7.4.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Events Manager plugin to a version that resolves this vulnerability.
Fixed in 7.4.7

Event History

Oct 10, 2026

CVE Published

via MITRE·07:35 PM

Data Sourced

via MITRE·07:35 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is described as subscriber SQL injection, so an attacker needs Subscriber-level access to a WordPress site using the affected plugin.

Is this exploitable remotely without user interaction?

The vector is network-based and requires no user interaction. However, the attacker must first have the required low-privileged Subscriber account access.

What security impact could successful exploitation have?

The provided CVSS vector indicates high confidentiality impact, no integrity impact, and low availability impact. The scope is changed, meaning the impact may extend beyond the vulnerable plugin's original security authority.

Which plugin versions are affected?

WordPress Events Manager versions 7.4.6 and earlier are identified as affected.

CVE-2026-42633: WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Is this exploitable remotely without user interaction?

What security impact could successful exploitation have?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Is this exploitable remotely without user interaction?

What security impact could successful exploitation have?

Which plugin versions are affected?