The vulnerability resides in the unescaped WordPress 'search' parameter of the EventON virtual event calendar plugin. An attacker can inject additional SQL statements when this parameter is processed, enabling extraction of sensitive data from the WordPress database. The weakness is classified as a code injection flaw (CWE‑89) and, due to the lack of query preparation, it can be exploited without authentication. If the "Enable additional search queries" option is active and at least one event is published, the attacker can download all rows from the target tables, potentially revealing usernames, passwords, and other confidential data.

All installations of the EventON virtual event calendar plugin for WordPress that use version 5.0.11 or earlier. The affected product is EventON (Pro), the fully featured WordPress plugin, where the flaw exists in the code handling the search feature.

This flaw carries a CVSS score of 9.8, indicating critical severity. The EPSS score is not available, suggesting no publicly reported exploitation data, and it is not listed in the CISA KEV catalog. The likely attack path involves a malicious user visiting a site that uses the affected plugin and submitting a crafted search query to the plugin’s endpoint. Because authentication is not required, the risk of exploitation is high once the plugin is deployed on a live site.