The Community Events plugin for WordPress contains an unescaped SQL injection vulnerability in the event_venue parameter that can be exploited through the SQL query compiled by the plugin. This flaw, classified as CWE‑89, allows a user to inject arbitrary SQL statements. When successful, an attacker can read or modify data stored in the WordPress database, potentially exposing user credentials, content, and configuration settings, and compromising the confidentiality and integrity of the site content.

All installations of the Community Events plugin version 1.5.1 or older from the vendor jackdewey are vulnerable. These versions are available on WordPress.org and may still be present on sites that have not applied updates since the fix was released.

The flaw has a CVSS score of 9.8, indicating a critical risk. The EPSS score is less than 1 %, suggesting that exploitation is currently low‑probability, yet the lack of a hard patch in the KEV catalog does not mitigate the potential for exploitation. Based on the description, the injection requires a user with Subscriber‑level access or higher; thus authentication is necessary, although some sources label it as unauthenticated. Exploitability requires the attacker to submit a crafted event_venue value in a request that the plugin processes, a step that is simple to automate once the vulnerability is known.