The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites that have manually added tribe_has_next_event() will be vulnerable to this SQL injection.
Metrics
Affected Vendors & Products
References
History
Wed, 25 Sep 2024 14:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Theeventscalendar
Theeventscalendar the Events Calendar |
|
CPEs | cpe:2.3:a:theeventscalendar:the_events_calendar:*:*:*:*:*:*:*:* | |
Vendors & Products |
Theeventscalendar
Theeventscalendar the Events Calendar |
|
Metrics |
ssvc
|
Wed, 25 Sep 2024 04:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites that have manually added tribe_has_next_event() will be vulnerable to this SQL injection. | |
Title | The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection | |
Weaknesses | CWE-89 | |
References |
|
|
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-09-25T04:30:28.690Z
Updated: 2024-09-25T13:49:03.800Z
Reserved: 2024-08-28T18:17:19.084Z
Link: CVE-2024-8275
Vulnrichment
Updated: 2024-09-25T13:48:55.988Z
NVD
Status : Awaiting Analysis
Published: 2024-09-25T05:15:11.497
Modified: 2024-09-26T13:32:02.803
Link: CVE-2024-8275
Redhat
No data.