CVE-2026-93300: EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it; no WordPress account or user interaction is required. The attack vector is the plugin's email parameter.
Which installations are affected?
All EventON - Subscriber versions up to and including 1.4.5 are affected. The available information does not identify any configuration prerequisite or disabled-by-default condition.
What can an attacker achieve?
An attacker can append SQL to an existing query through the email parameter and use it to extract sensitive information from the WordPress database. The provided data describes confidentiality impact only, with no stated integrity or availability impact.