CVE-2026-97287: WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability
Published Sep 30, 2026
·Updated
Contributor SQL Injection in Event Tickets <= 5.29.5 versions.
Affected Software
1 affected component
The Events Calendar Event Tickets<=5.29.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Event Tickets pluginto a version that resolves this vulnerability.Fixed in 5.29.5.1
Event History
Sep 30, 2026
CVE Published
via MITRE·12:28 PM
Data Sourced
via MITRE·12:28 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker needs Contributor-level privileges. The CVSS vector indicates low privileges are required and no user interaction is needed.
2
Can this be exploited over the network?
Yes. The attack vector is network-based, so a Contributor-level user could potentially exploit it remotely against an affected installation.
3
What is the expected security impact?
The supplied CVSS vector indicates high confidentiality impact and low availability impact. It indicates no direct integrity impact, with scope changed.