The EventON - Subscriber plugin for WordPress contains a generic SQL Injection vulnerability that is triggered by the 'email' parameter. Unsanitized input is directly appended to an existing SQL query, allowing an unauthenticated attacker to inject additional SQL statements. This can be used to read sensitive data from the database and may also enable modification or deletion of data, resulting in a breach of confidentiality and integrity.

WordPress sites that have the EventON - Subscriber plugin installed, specifically all releases up to and including version 1.4.5. The vulnerability exists in the code that constructs database queries based on the 'email' field supplied by visitors.

The CVSS score of 7.5 indicates a high severity. Although no EPSS score is provided, the attack vector is unauthenticated and can be exploited remotely via the plugin’s publicly accessible parameter. The vulnerability is not listed in CISA’s KEV catalog, but the lack of input sanitization makes exploitation likely on any site that hosts the affected plugin. Attackers could therefore obtain or alter database contents without authentication.