The Community Events plugin for WordPress incorporates the event_category parameter directly into SQL statements without proper escaping or the use of prepared statements. This flaw allows an attacker who has the ability to submit a value for event_category to inject additional SQL commands. The injected payload can be appended to the original query, enabling unauthorized extraction of data stored in the WordPress database. The damage is limited to the confidentiality of stored data; there is no evidence of privilege escalation to other system resources.

All installations of the Community Events plugin released by jackdewey up to and including version 1.5.1 are affected. The vulnerability is triggered whenever the event_category field is processed by the plugin, which occurs during event creation or modification on a WordPress site. The flaw exists in every release in that version range and does not affect later versions where input sanitisation and prepared statements have been implemented.

The CVSS score of 9.8 indicates a high severity vulnerability, and the EPSS score of less than 1% suggests that, while exploitation is unlikely, it remains a realistic threat. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Subscriber-level access or higher who can submit or edit event_category data. Attackers would typically send a crafted HTTP request containing malicious SQL, or use automated scripts to discover and exploit the flaw, thereby leaking sensitive database contents.