Event Tickets: SQL injection in ORDER BY via array-form orderby parameter

Summary

Event Tickets is a WordPress plugin for event ticketing and RSVPs. Due to an input validation flaw in the Tickets Commerce Orders report, a user with Contributor rights can inject SQL through the array form of the orderby parameter, and the sort direction bypasses the existing ASC/DESC check. An attacker can use this blind SQL injection to read any table in the database, including administrator password hashes, user email addresses and order data such as purchaser names and payment metadata. The attack requires Tickets Commerce to be enabled and at least one order to exist.

Affected

• Event Tickets WordPress plugin up to and including 5.29.5
• Earliest affected version not stated ("n/a" in the CVE record)

Fixed in

• Event Tickets 5.29.5.1 (according to the CVE record, Patchstack and Intrudify)

Workaround

• Unknown. No vendor-confirmed workaround found.
• Until the update is applied, restrict Contributor and higher accounts to trusted people and remove unused accounts.
• Consider deactivating the plugin on sites where ticketing is not business-critical.

Exploitation

• No known exploitation in the wild.
• CISA SSVC assessment: exploitation none, automatable no, technical impact partial.
• The vulnerability was published with technical details by the reporter (Intrudify).

Our recommendation

• Update Event Tickets to 5.29.5.1 or later. Verify the fixed version on the WordPress.org changelog or the Patchstack page.
• Patch CVE-2026-97634 at the same time, as it describes the same issue according to Patchstack.
• Check which accounts have Contributor or higher rights and remove unnecessary accounts. Disable open registration if not needed.
• Review the database and web server logs for unusual database errors or long-running requests on order or ticket pages.
• Take a backup before updating.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack: WordPress Event Tickets Plugin <= 5.29.5 SQL Injection patchstack.com
• Intrudify: CVE-2026-97287 advisory intrudify.com
• OpenCVE: CVE-2026-97287 app.opencve.io
• GitHub: Event Tickets release 5.29.5 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:42.