CVE-2026-9700

Name of the Vulnerable Software and Affected Versions Eventer versions prior to 4.4.3

Description The Eventer plugin for WordPress contains a time-based SQL Injection flaw. This occurs because the plugin fails to properly escape the code parameter and lacks sufficient preparation of the SQL query. Unauthenticated attackers can exploit this by appending additional SQL queries to existing ones, allowing the extraction of sensitive information from the database.

Recommendations Update the plugin to a version newer than 4.4.2. As a temporary mitigation, restrict access to the functionality utilizing the code parameter.