CVE-2026-9711: EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter

Synopsis

Blind SQL injection in the EventON WordPress Virtual Event Calendar Plugin (versions up to and including 5.0.11) allows an unauthenticated remote attacker to append arbitrary SQL to search queries. The vulnerability is reachable over the network with no credentials required, and it is conditional on the plugin's "Enable additional search queries" setting being active and at least one published event existing in the database. Successful exploitation gives the attacker read and write access to the underlying WordPress database and can disrupt service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin's search endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS to deliver the malicious search parameter.

• AuthenticationNot required

  No account or session token is needed; the vulnerable search parameter is processed for anonymous requests.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or administrator of the target site.

• Attack complexityDetail

  The exploit is reliable and condition-free from a technical standpoint, though two environmental prerequisites must hold: the "Enable additional search queries" setting must be active and at least one published event must exist in the database.

Blast Radius

• Reads arbitrary rows from the WordPress database, including user account records, password hashes, session tokens, and plugin configuration data.
• Modifies or deletes persisted database rows, allowing an attacker to alter event content, create rogue administrator accounts, or corrupt site data.
• Extracts secrets stored in WordPress options, such as API keys, payment gateway credentials, or private configuration values held in the wp_options table.
• Crashes or degrades database-driven functionality by injecting resource-exhausting queries, disrupting site availability for legitimate users.