Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FooEvents FooEvents for WooCommerce fooevents allows SQL Injection.This issue affects FooEvents for WooCommerce: from n/a through <= 1.20.4.
Published: 2026-01-22
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An improperly neutralized input in the FooEvents for WooCommerce WordPress plugin permits attackers to inject arbitrary SQL commands. The flaw, classified as CWE‑89, can lead to unauthorized reading, modification, or deletion of database records. The vulnerability exists in all releases up to and including version 1.20.4.

Affected Systems

WordPress installations that use FooEvents for WooCommerce plugin version 1.20.4 or earlier are affected. Users should review the plugin version deployed on their sites and plan an upgrade if necessary.

Risk and Exploitability

The CVSS score of 8.5 indicates high severity, while the EPSS score of less than 1% suggests exploitation is currently uncommon. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the flaw remotely by sending crafted HTTP requests containing malicious input to the plugin's endpoints, assuming no additional input validation is in place. Because the flaw resides in the plugin's database interaction layer, it does not require local code execution or elevated privileges to be triggered.

Generated by OpenCVE AI on April 29, 2026 at 10:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FooEvents for WooCommerce to version 1.20.5 or later to apply the vendor fix.
  • If an immediate upgrade is not possible, deploy a web application firewall or similar filtering to block SQL injection patterns on the plugin’s endpoints.
  • Monitor application and database logs for suspicious query activity or error messages that may indicate attempted exploitation.

Generated by OpenCVE AI on April 29, 2026 at 10:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Jan 2026 01:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 28 Jan 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'}

 cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Tue, 27 Jan 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Fooevents
Fooevents fooevents For Woocommerce
Woocommerce
Woocommerce woocommerce
Wordpress
Wordpress wordpress
Vendors & Products Fooevents
Fooevents fooevents For Woocommerce
Woocommerce
Woocommerce woocommerce
Wordpress
Wordpress wordpress

Thu, 22 Jan 2026 23:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FooEvents FooEvents for WooCommerce fooevents allows SQL Injection.This issue affects FooEvents for WooCommerce: from n/a through <= 1.20.4.
Title WordPress FooEvents for WooCommerce plugin <= 1.20.4 - SQL Injection vulnerability
Weaknesses CWE-89
References

Subscriptions

Fooevents Fooevents For Woocommerce
Woocommerce Woocommerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T20:35:17.822Z

Reserved: 2025-12-29T11:18:51.164Z

Link: CVE-2025-69045

cve-icon Vulnrichment

Updated: 2026-01-27T15:44:14.097Z

cve-icon NVD

Status : Deferred

Published: 2026-01-22T17:16:17.763

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-69045

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T10:45:09Z

Weaknesses