Security Alert Summary
The EventON – Subscriber plugin for WordPress contains a SQL injection vulnerability in the email parameter present in all versions up to and including 1.4.5. Insufficient escaping and lack of proper query preparation allow unauthenticated attackers to append SQL to existing queries, which can be used to extract sensitive data from the site’s database.
CVE Details
- CVE ID: CVE-2026-93300
- Affected component: EventON – Subscriber plugin for WordPress
- Affected versions: All versions up to and including 1.4.5
- Published: October 20, 2026 at 6:16:57 AM
- Last modified: October 20, 2026 at 6:16:57 AM
- CVSS v3.1: Base Score 7.5, Severity HIGH
- Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- User Interaction: NONE
- Scope: UNCHANGED
- Impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Authentication / Privileges / User interaction: No authentication required, no privileges required, and no user interaction required to exploit.
- CWE: CWE-89 (SQL Injection)
Technical Details
The vulnerability is a generic SQL injection in the plugin’s handling of the email parameter. User-supplied input is not sufficiently escaped and the existing SQL query is not adequately prepared, which permits an attacker to append additional SQL statements to the intended query. The CVE description indicates this affects all versions up to and including 1.4.5.
Because the issue is a SQL injection, an attacker who crafts a malicious email value can cause the application to execute unintended SQL, allowing extraction of data from the database. The description does not name specific functions or REST endpoints beyond the vulnerable parameter, so remediation should focus on properly escaping input and using prepared statements or parameterized queries where the email value is used.
How This Could Impact Your Website
In a typical WordPress environment with multiple users, the site owner or administrator might rely on the EventON – Subscriber plugin to collect attendee or subscriber emails. An unauthenticated attacker exploiting this SQL injection could extract stored data such as subscriber or user email addresses from the database. This may expose internal staff or contributor contact information and increase the risk of targeted phishing or social engineering against your organization.
For example, a site owner, an internal content editor, and an external contributor could all have their email addresses exposed if those addresses are stored in the same database tables accessible via the vulnerable query. Exposed addresses can lead to credential phishing attempts or social-engineering attacks targeting your team or contractors. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level and lower-privileged accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and database access logs for unusual behavior or large query results that may indicate data extraction attempts.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
