CVE-2026-49772: WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability

Synopsis

SQL injection vulnerability in the The Events Calendar WordPress plugin (versions 6.15.12 through 6.16.2) allows an unauthenticated remote attacker to send crafted HTTP requests to the affected site without any prior login. Successful exploitation enables blind SQL injection against the underlying database, giving an attacker read access to sensitive stored data and limited ability to disrupt service availability. No fix version has been published yet; HarborGuard tracks the upstream advisory and will surface a patched-image rebuild the moment one becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker can reach it from the internet without any prior foothold on the host.

• AuthenticationNot required

  No account or session token is needed; the injection can be triggered by any unauthenticated HTTP request.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the server endpoint.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or environmental prerequisites.

Blast Radius

• An attacker can extract arbitrary rows from the WordPress database through blind SQL injection techniques, including user credentials, password hashes, session tokens, and stored event data.
• Database availability is partially impacted; resource-heavy injected queries can degrade or briefly disrupt query processing on the affected instance.
• Because the CVSS scope is Changed, a successful injection against the WordPress database layer can expose data belonging to other applications or tenants sharing the same database server.