CVE-2024-11260
Published: 21 February 2025
Description
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in all versions up to, and including, 6.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Security Summary
CVE-2024-11260 is a time-based SQL injection vulnerability affecting the Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress in all versions up to and including 6.6.3. The flaw arises from insufficient escaping of the user-supplied active_status parameter and lack of sufficient preparation in the existing SQL query within the em-events.php component, allowing attackers to append additional SQL queries.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Successful exploitation enables extraction of sensitive information from the database without impacting integrity or availability.
Mitigation details and further analysis are available in advisories from Wordfence and the plugin's source code repository, including the vulnerable code at line 606 in em-events.php.
Details
- CWE(s)