The vulnerability arises from the lack of escaping and preparation of the user‑supplied 's' parameter in the Events Calendar plugin, enabling a time‑based SQL injection. An attacker can append arbitrary SQL clauses to existing queries and retrieve sensitive data from the database, compromising confidentiality. The flaw does not allow remote code execution but does permit unauthorized disclosure of database contents.

The affected product is the WordPress plugin "The Events Calendar" developed by stellarwp. All bundled releases with version numbers up to and including 6.15.1 are vulnerable; later releases are presumed fixed based on the version boundary provided by the CNA.

The CVSS score of 7.5 marks the flaw as high severity, yet the EPSS score of less than 1 % indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV, implying no known large‑scale exploitation campaigns. The likely attack vector is any HTTP request containing the 's' parameter, which does not require authentication. Without remediation, attackers could exfiltrate confidential database information.