The Event Manager plugin for WordPress contains a second‑order SQL injection flaw that arises when the stored meta_key value is concatenated into an INSERT query without proper escaping. An attacker who can add a custom meta key, which WordPress records verbatim in wp_postmeta, can later trigger the injection by invoking the event_duplicate or location_duplicate action. The vulnerability allows the attacker to append arbitrary SQL statements to the existing query, thereby reading or manipulating sensitive data from the database.

All installations of netweblogic's Events Manager – Calendar, Bookings, Tickets, and more! plugin up to and including version 7.4.0 are affected. The flaw exists in the core plugin code that handles event and location duplication within WordPress, and it is present in all releases up to the aforementioned version threshold.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is currently not available, suggesting limited publicly known exploitation activity. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a web‑based attack vector and an authenticated user role of contributor or higher. Based on the description, the likely attack path involves planting malicious meta data, then triggering the duplicate action to activate the injected SQL. The overall risk to an affected WordPress site is the potential loss of sensitive database information.