Events Manager WordPress plugin: SQL injection by authenticated subscribers
Summary
The WordPress Events Manager plugin in versions up to and including 7.4.6 contains an SQL injection flaw (CWE-89). An attacker with a Subscriber account can inject SQL queries and read, modify or delete data in the WordPress database, including user accounts and private data. The attacker needs only a low-privilege account, which is often obtainable on sites with open registration.
Affected
- Events Manager WordPress plugin (WordPress Events Manager - Calendar, Bookings, Tickets, and more!), versions up to and including 7.4.6
- Required privilege: Subscriber
Fixed in
- Version 7.4.7 fixes CVE-2026-42633 according to Patchstack and other vulnerability databases.
- Patchstack lists 7.4.10 as the current release. Verify the latest version on the WordPress.org plugin page before rollout.
Workaround
- No vendor-published workaround. Updating is the remedy.
- If patching must be delayed: restrict or disable open subscriber registration and review existing subscriber accounts.
- Patchstack offers a mitigation rule for its customers; this is not a vendor fix.
Exploitation
- Not listed in CISA KEV at the time of research.
- No public proof-of-concept found; this does not rule one out.
- EPSS 0.00332 (Rapid7/Vulners).
- CISA SSVC: exploitation none, automatable no. Patchstack describes the flaw as likely to be exploited in mass campaigns.
Our recommendation
- Update the Events Manager plugin to version 7.4.7 or later, and check the current release on WordPress.org.
- Review subscriber and customer accounts for unknown or recently created users.
- Check the database and booking data for unexpected changes.
- Monitor web server and WAF logs for SQL injection patterns.
- Priority is high for sites with user registration or booking functions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: WordPress Events Manager plugin <= 7.4.6 SQL Injection patchstack.com
- HOL Guard: CVE-2026-42633 advisory hol.org
- Really Simple Security: Events Manager vulnerability record vulnerabilities.really-simple-security.com
- WPScan: Events Manager plugin wpscan.com
- Rapid7/Vulners: CVE-2026-42633 (EPSS) vulners.com
- OpenCVE: CVE-2026-42633 app.opencve.io
- Strix: CVE-2026-42633 www.strix.ai
- WordPress.org: Events Manager plugin wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:00.
Original description (NVD)
Subscriber SQL Injection in Events Manager <= 7.4.6 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.