External risk intelligence

EventON WordPress Plugin SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-9711

The vulnerability exists in a WordPress plugin designed for public-facing event calendars. Such plugins are typically deployed on websites accessible to the public internet, and the injection point is via the standard web search functionality, making the vulnerable surface commonly exposed to internet traffic.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects WordPress event calendar plugins, potentially allowing attackers to access sensitive database information without needing any special permissions. The main concern is confirming if our organization uses this specific plugin and is exposed.

Plugin flaw allows attackers to steal data.
Affects public-facing websites and customer data.
Confirm usage and assess exposure immediately.

Attack Path

How an attacker could exploit the issue

An attacker can target the EventON WordPress plugin through its search functionality. By manipulating the 'search' parameter, they can inject malicious SQL queries. This attack requires the "Enable additional search queries" setting to be active and at least one event to be published on the site, potentially allowing unauthorized access to sensitive database information.

No authentication required to start.
Triggered by manipulating the search parameter.
Risk of sensitive data extraction.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary SQL queries against the WordPress database when the "Enable additional search queries" setting is active and a published event exists. This could lead to the disclosure of sensitive information stored within the database.

Sensitive database information may be exposed.
Attackers can inject malicious SQL queries.
Unauthenticated data extraction is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The EventON WordPress plugin's SQL injection vulnerability, accessible via the 'search' parameter, requires immediate attention from teams managing WordPress sites and their associated plugins. The first step is to identify all instances of the EventON plugin, determine their reachability and business criticality, and pinpoint the accountable owner for remediation.

WordPress site administrators/owners.
Verify EventON plugin usage and reachability.
Plan and execute remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the EventON WordPress plugin?

EventON is a plugin designed to create and manage virtual event calendars on WordPress websites. Users rely on it to display schedules, event details, and registration information to site visitors. It integrates into the WordPress ecosystem to provide interactive, public-facing calendar functionality.

What does CVE-2026-9711 mean regarding SQL injection?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. Simply put, the plugin fails to properly sanitize user input before including it in a database query. Because the software does not distinguish between legitimate search terms and malicious code, an attacker can manipulate the search parameter to run unauthorized commands and access sensitive database information.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to the site's search function. Crucially, the vulnerability remains dormant unless the specific 'Enable additional search queries' setting is toggled on within the plugin configuration. Furthermore, the attack path requires at least one published event to exist on the calendar for the injection to succeed.

Is my website at risk from this CVE?

According to Halo Surface Signal, this vulnerability is considered a likely risk because EventON is typically deployed on public-facing websites. If your instance is accessible to the internet and uses the affected plugin version, your database could be exposed to unauthenticated actors. Internal-only sites may face lower risk, but public calendar deployments are primary targets.

What are the first steps to secure my WordPress site?

Begin by auditing your WordPress environment to identify if EventON is installed and determine the version in use. If present, immediately check if the 'Enable additional search queries' setting is active. Prioritize verifying ownership of these instances to coordinate an update or mitigation, ensuring that any business-critical calendar data is protected from unauthorized database queries.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.