PT-2025-10065 · WordPress · The Eventer

Lucio Sá · Published 2025-03-07 · Updated 2025-03-08 · CVE-2025-0959

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Eventer - WordPress Event & Booking Manager Plugin versions up to, and including, 3.9.9.2

Description The issue allows authenticated attackers with Subscriber-level access and above to extract sensitive information from the database due to insufficient escaping on the user-supplied reg id parameter and lack of sufficient preparation on the existing SQL query. This enables attackers to append additional SQL queries into already existing queries.

Recommendations For versions up to, and including, 3.9.9.2, consider restricting access to the reg id parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the reg id parameter in affected queries until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-564

CWE-89

Related Identifiers

CVE-2025-0959

Affected Products

The Eventer

References · 12

• https://osv.dev/vulnerability/CVE-2025-0959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0959 · Security Note
• https://twitter.com/VulmonFeeds/status/1898025122302210144 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/bd42c89e-57db-458f-910c-404a5615f280?source=cve · Note
• https://twitter.com/cybercronai/status/1898018458807193829 · Twitter Post
• https://twitter.com/CVEnew/status/1898246394164486641 · Twitter Post
• https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534 · Note
• https://twitter.com/WolfgangSesin/status/1897998348495294897 · Twitter Post
• https://t.me/cvetracker/18655 · Telegram Post
• https://t.me/latest_high_impact_cve/1931 · Telegram Post
• https://t.me/cvedetector/19816 · Telegram Post
• https://twitter.com/CveFindCom/status/1897928008087851426 · Twitter Post