The Eventer plugin for WordPress is vulnerable to SQL Injection through the reg_id parameter due to missing escaping and inadequate query preparation. This flaw allows an authenticated user with Subscriber-level access or higher to inject arbitrary SQL statements, enabling the attacker to read sensitive database contents such as user data or booking details, representing a CWE‑89 injection issue and a potential privacy violation (CWE‑564).

All releases of the Eventer – WordPress Event & Booking Manager Plugin up to and including version 3.9.9.2 are affected. The plugin is distributed by imithemes for WordPress sites and any site that has installed these versions is susceptible.

With a CVSS score of 8.8, the vulnerability is classified as high severity. However, its EPSS score is below 1%, indicating a very low current chance of exploitation. The issue is not listed in the CISA KEV catalog, and the expected attack vector requires the attacker to be authenticated as a Subscriber or higher, accessing the plugin through valid WordPress credentials. In practice, the risk is moderate but the potential impact of data extraction warrants prompt remediation.