The Registrations for the Events Calendar plugin for WordPress can be manipulated by an attacker who can submit JSON data to the 'standard' POST parameter. The code decodes the JSON and uses its keys as column identifiers in an UPDATE statement. Only esc_sql() is applied, which does not escape spaces, equals signs, parentheses, or hyphens, allowing an attacker to terminate the identifier and inject arbitrary SQL sub‑queries. The flaw is a classic instance of CWE-89 injection. An attacker can therefore read sensitive database content or modify data beyond the intended event record.

WordPress sites that have the roundupwp Registrations for the Events Calendar – Event Registration Plugin installed in any version up to and including 3.2 are affected. The vulnerability is tied to the admin AJAX action rtec_records_edit that performs event record editing.

The CVSS score of 6.5 indicates moderate severity; the EPSS score of <1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication with at least Contributor-level privileges, but does not require administrative rights. If successfully exploited, the attacker can extract sensitive information from the database or alter event records.