rootpwn

medium · CVSS v3 6.5 · EPSS 0.00281

CVE-2026-97634

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL injection via the 'orderby' parameter in all versions u

Overview

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL injection via the 'orderby' parameter in all versions up to 5.29.5. Authenticated users with contributor-level access can inject SQL and extract sensitive data. The flaw arises from insufficient escaping and lack of prepared statements.

Description

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id they authored, as the can_access_page() gate requires only post authorship rather than the edit_others_posts capability for post owners.

Impact

Confidentiality: attackers can read arbitrary database tables. Integrity: potential to modify data if injection allows. Availability: not directly impacted. Defenders: site administrators, plugin maintainers, and users with contributor-level access are at risk.

Remediation

Upgrade the plugin to version 5.29.6 or later where the 'orderby' parameter is properly sanitized and prepared statements are used. If upgrade is not possible, restrict contributor-level users from accessing the vulnerable endpoint or disable the 'orderby' functionality via custom code. Additionally, implement web application firewall rules to block suspicious SQL patterns.

Risk context

Severity is medium (CVSS 6.5) and EPSS is 0.00281, indicating low likelihood of exploitation but still relevant for sites with contributor accounts. Prompt patching is recommended to mitigate potential data exposure.

Affected products

  • WordPress Event Tickets and Registration plugin

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
—
EPSS
0.00281

SQL Injection WordPress Event Tickets Contributor Access Medium Severity Data Exfiltration

← All CVEs

Related CVEs

medium

CVE-2026-103762

SiYuan before v3.8.5 has a missing authorization flaw in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read‑only or anonymous publish visitors to discover unpublished notebook box IDs and their creation times. Attackers can POST any open notebook ID to receive the global save‑box ID and save‑path template, revealing hidden notebooks. The vulnerability does not modify data but exposes sensitive metadata.

View analysis

medium

CVE-2026-104910

MISP suffers an authorization bypass in its related events listing, allowing users to retrieve metadata of events they should not see. This can expose threat‑intelligence details across sharing groups.

View analysis

medium

CVE-2026-92826

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the enable_help option is active, as the vulnerable HelpScout Beacon script block is only emitted when that setting is enabled.

View analysis

medium

CVE-2025-12828

Ultra Addons Lite for Elementor plugin is vulnerable to stored XSS via the Type Out widget in all versions up to 1.3.2, allowing authenticated contributors to inject malicious scripts into pages. This flaw can lead to defacement, session hijacking, or data theft when users view affected pages. The issue is present in all WordPress installations using the affected plugin.

View analysis