The CP Multi View Event Calendar WordPress plugin contains a SQL injection flaw that allows attackers to inject arbitrary SQL into the backend database. Because user‑supplied parameters are concatenated into SQL statements without proper escaping, an attacker who can reach the plugin’s endpoints could read, modify, or delete data stored in the WordPress database. The vulnerability is a classic example of CWE‑89, where improper neutralization of special elements used in an SQL command leads to unauthorized database access. The injection could ultimately enable full control over the WordPress installation if the database user has sufficient privileges.

The vulnerability affects the Codepeople CP Multi View Event Calendar plugin for WordPress. All installations of the plugin version 1.4.41 or earlier are susceptible. WordPress sites that have not upgraded to version 1.4.42 or later, and therefore still run a vulnerable version, are at risk. There is no requirement for elevated site or administrative rights to trigger the flaw; any user who can access the plugin’s public URLs or form fields may exploit it.

With a CVSS score of 8.5, the flaw is considered high severity. The EPSS score of less than 1 % indicates that, as of this analysis, exploit attempts appear rare, and the vulnerability is not listed in the CISA KEV catalog, meaning no widely available exploits are known. Nonetheless, because the injection can be triggered through ordinary HTTP requests to the plugin and does not require special authentication, the risk of exploitation by malicious actors who can reach the site remains significant. The attack vector is inferred from the description to be an HTTP endpoint that accepts unvalidated input from the user.