CVE-2026-42633

Summary

A SQL injection vulnerability in Events Manager plugin allows authenticated subscribers to execute arbitrary SQL commands, potentially leading to full database access and data compromise.

Exploitability

Exploitation requires an authenticated subscriber account with minimal privileges, making it moderately difficult but achievable through social engineering or compromised credentials.

Blast radius

If exploited, this vulnerability could allow attackers to extract sensitive user data, modify event records, and potentially escalate privileges within the WordPress environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Events Manager version 7.4.7 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.