CVE-2026-97287: WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection.
This issue affects Event Tickets: from n/a through 5.29.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Event Tickets pluginto a version that resolves this vulnerability.Fixed in 5.29.5.1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs Contributor-level privileges. The CVSS vector indicates low privileges are required and no user interaction is needed.
Can this be exploited over the network?
Yes. The attack vector is network-based, so a Contributor-level user could potentially exploit it remotely against an affected installation.
What is the expected security impact?
The supplied CVSS vector indicates high confidentiality impact and low availability impact. It indicates no direct integrity impact, with scope changed.