PT-2022-9587 · WordPress · Events Made Easy

Krzysztof Zając · Published 2022-01-03 · Updated 2022-01-11 · CVE-2021-25030

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Events Made Easy WordPress plugin versions prior to 2.2.36

Description The issue concerns the Events Made Easy WordPress plugin, which does not properly sanitise and escape the search text parameter before using it in a SQL statement via the "eme searchmail" AJAX action. This action is available to any authenticated users, allowing those with a role as low as subscriber to perform SQL injection attacks.

Recommendations For versions prior to 2.2.36, update to version 2.2.36 or later to resolve the issue. As a temporary workaround, consider restricting access to the "eme searchmail" AJAX action to prevent exploitation. Avoid using the search text parameter in the affected AJAX endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-25030

Affected Products

Events Made Easy

References · 4

• 🔥 https://wpscan.com/vulnerability/bc7058b1-ca93-4c45-9ced-7848c7ae4150 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25030 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25030 · Vendor Advisory
• https://t.me/cibsecurity/34857 · Telegram Post