A blind SQL injection flaw exists in the WordPress Event Tickets plugin, allowing an attacker to inject unsanitized input into SQL commands. This defect, identified as CWE‑89, can be exploited to read, modify, or delete data in the WordPress database. The vulnerability arises when special elements are not properly neutralized in a database query, giving an attacker the ability to execute arbitrary SQL statements. Because the resulting injection is blind, the attacker may not receive immediate feedback, but can still infer information through side‑channel techniques such as timing or error responses.

The issue affects the WordPress Event Tickets plugin up to and including version 5.29.5. Vendors affected include Liquid Web / StellarWP:Event Tickets, and any implementation using these versions is vulnerable. The fix is incorporated in 5.29.5.1 and newer releases.

The CVSS score of 8.5 indicates high severity. The EPSS score reflects a very low probability of exploitation (under 1 %). The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers would need to supply malicious input to the plugin, which may require an authenticated contributor account or other privilege to reach the vulnerable endpoint. Once the endpoint is reached, the attacker can inject SQL to read, modify, or delete arbitrary data, potentially leading to significant confidentiality and integrity breaches.