Description
The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'dayofyear' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-11-19
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted SQL injection enabling data extraction
Action: Immediate Patch
AI Analysis

Impact

The Community Events plugin for WordPress contains an unauthenticated SQL injection flaw in the "dayofyear" query parameter. Because the input is not properly escaped and the existing SQL statement is not parameterized, attackers can inject additional SQL statements into the request. This weakness, classified as CWE-89, permits unauthorized users to retrieve sensitive information from the WordPress database.

Affected Systems

The vulnerability affects the Community Events WordPress plugin supplied by jackdewey. All released versions up to and including 1.5.4 are vulnerable; versions 1.5.5 and later are assumed to have the flaw fixed.

Risk and Exploitability

The issue has a CVSS score of 7.5, indicating moderate‑to‑high severity. The EPSS score is below 1 %, suggesting that exploitation probability is low at present, and it is not listed in the CISA KEV catalog. Attackers would exploit the flaw by sending unauthenticated HTTP requests with a crafted "dayofyear" value to the plugin’s endpoint, enabling injection of arbitrary SQL that can read confidential database contents.

Generated by OpenCVE AI on April 22, 2026 at 00:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Community Events plugin to the latest available version (≥ 1.5.5) to remove the injection point.
  • If an immediate upgrade is not possible, block or rate‑limit HTTP requests that contain the "dayofyear" parameter to the plugin’s endpoint, for example by configuring a web‑application firewall rule.
  • Re‑configure the WordPress database user that the site uses to have read‑only permissions on the tables accessed by the plugin, limiting damage if the injection succeeds.

Generated by OpenCVE AI on April 22, 2026 at 00:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Nov 2025 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Jackdewey
Jackdewey community Events
Wordpress
Wordpress wordpress
Vendors & Products Jackdewey
Jackdewey community Events
Wordpress
Wordpress wordpress

Wed, 19 Nov 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Nov 2025 06:00:00 +0000

Type Values Removed Values Added
Description The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'dayofyear' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Title Community Events <= 1.5.4 - Unauthenticated SQL Injection
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Jackdewey Community Events
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:54:25.500Z

Reserved: 2025-11-03T20:00:54.300Z

Link: CVE-2025-12646

cve-icon Vulnrichment

Updated: 2025-11-19T20:23:10.542Z

cve-icon NVD

Status : Deferred

Published: 2025-11-19T06:15:46.073

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-12646

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T00:45:04Z

Weaknesses