The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites that have manually added tribe_has_next_event() will be vulnerable to this SQL injection.
Metrics
Affected Vendors & Products
References
History
Wed, 02 Oct 2024 19:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Stellarwp
Stellarwp the Events Calendar |
|
CPEs | cpe:2.3:a:stellarwp:the_events_calendar:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Stellarwp
Stellarwp the Events Calendar |
Wed, 25 Sep 2024 14:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Theeventscalendar
Theeventscalendar the Events Calendar |
|
CPEs | cpe:2.3:a:theeventscalendar:the_events_calendar:*:*:*:*:*:*:*:* | |
Vendors & Products |
Theeventscalendar
Theeventscalendar the Events Calendar |
|
Metrics |
ssvc
|
Wed, 25 Sep 2024 04:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites that have manually added tribe_has_next_event() will be vulnerable to this SQL injection. | |
Title | The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection | |
Weaknesses | CWE-89 | |
References |
|
|
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-09-25T04:30:28.690Z
Updated: 2024-09-25T13:49:03.800Z
Reserved: 2024-08-28T18:17:19.084Z
Link: CVE-2024-8275
Vulnrichment
Updated: 2024-09-25T13:48:55.988Z
NVD
Status : Analyzed
Published: 2024-09-25T05:15:11.497
Modified: 2024-10-02T19:14:54.870
Link: CVE-2024-8275
Redhat
No data.