The Community Events plugin for WordPress contains a SQL injection flaw in the on_save_changes_venues function that processes the ce_venue_name field from a CSV upload. The input is not escaped or prepared, allowing an attacker with Administrator privileges to insert arbitrary SQL fragments into the query. This can be used to read confidential information from the database, such as event details, user data, or other posts, effectively resulting in unauthorized data disclosure. The vulnerability is a classic instance of CWE-89.

All installations of the Community Events plugin version 1.5.8 or earlier, used in WordPress sites where the site administrator or a higher‑privilege user can upload CSV files via the venue editing interface. Any WordPress installation running these plugin versions is vulnerable as long as the vulnerable code path is reachable.

The CVSS score of 4.9 reflects moderate severity, and the EPSS score of less than 1% indicates a very low current exploitation probability. The issue is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. An attacker would need to log into the WordPress admin area, upload a crafted CSV file using the plugin’s venue editing feature, and have their SQL payload execute. Because the attack requires authenticated access and a specific plugin feature, the real‑world risk is limited to compromised or poorly secured sites where an administrator could be tricked or maliciously used.