CVE-2026-15023

Name of the Vulnerable Software and Affected Versions The Events Manager – Calendar, Bookings, Tickets, and more! versions prior to 7.4.1

Description An issue exists where authenticated attackers with contributor-level access and above can perform a second-order SQL injection. This occurs when an attacker first stores SQL metacharacters in a custom meta key through the standard add-meta flow. The injection is then triggered by invoking the event duplicate or location duplicate actions, which retrieve the stored meta keys via the get post meta() function and unsafely concatenate them into an INSERT query. This flaw is caused by insufficient escaping of the meta key parameter and a lack of proper preparation of the SQL query, allowing the extraction of sensitive information from the database.

Recommendations Update to version 7.4.1 or later.