The vulnerability in the eventer plugin arises from improper sanitization of user input that becomes part of a SQL command. This flaw allows an attacker to inject arbitrary SQL statements, leading to blind SQL injection. An attacker can read, modify, or delete database contents through the plugin, compromising the confidentiality and integrity of the site’s data. The weakness is classified as CWE-89.

The flaw is present in all releases of the Eventer plugin by imithemes up to, but not including, version 3.11.4. Any WordPress installation hosting a vulnerable instance of this plugin is affected.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score is below 1 %, suggesting a low likelihood of exploitation in the current environment, and the issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be through user‑controllable inputs within the plugin, potentially accessible to unauthenticated users or those with limited privileges. Proper authentication and input validation are therefore essential defenses. The CWE‑89 identifier signals that the flaw arises from insufficient input validation affecting command execution.