CVE-2025-69135: SQL Injection in WordPress Events Calendar Plugin v2.7.2 and Earlier

Technical summary

CVE-2025-69135 is a subscriber-level SQL injection (CWE-89) in the WordPress Events Calendar plugin affecting versions up to and including 2.7.2. The vulnerability exists in the Events Schedule functionality where user-supplied input is not properly sanitized before being incorporated into SQL queries. The CVSS 3.1 score of 8.5 (HIGH) reflects a network-accessible attack vector with low complexity, requiring only valid subscriber credentials. The impact includes high confidentiality risk (C:H) through unauthorized database disclosure, limited availability impact (A:L), and no integrity compromise (I:N). The scope is changed (S:C), indicating the vulnerability can affect resources beyond the vulnerable component.

Business impact

For WordPress site operators running Events Calendar, this vulnerability creates a direct pathway for insider threats and compromised subscriber accounts to access sensitive data. Database exposure could include user information, event details, customer records, and configuration data. Organizations with event booking functionality face particular risk, as financial or personal information may be extracted. The requirement for subscriber access limits exposure to public-facing threats but significantly elevates risk from disgruntled staff, inactive users with retained credentials, or accounts obtained through social engineering.

Affected systems

WordPress Events Calendar plugin versions 2.7.2 and earlier are affected. The vulnerability is specific to installations where the Events Schedule feature is active and accessed by authenticated users. Sites using alternative event management plugins or those that have fully disabled the Events Calendar plugin are not impacted.

Exploitability

This vulnerability is exploitable by any user with WordPress subscriber-level (or higher) credentials. No special privileges, social engineering, or user interaction is required beyond obtaining valid login credentials. The attack is straightforward to execute for someone with SQL injection knowledge. However, the requirement for authenticated access provides a baseline protection compared to unauthenticated SQL injection. The lack of CISA KEV designation indicates no evidence of in-the-wild exploitation as of the publication date, though this should not be interpreted as a guarantee of future safety.

Remediation

Update the WordPress Events Calendar plugin to a patched version released after 2.7.2. Verify the patch version number directly from the official WordPress plugin repository or vendor advisory, as version numbers may vary by distribution channel. As a supplementary measure, restrict Events Calendar access to trusted user roles, disable the Events Schedule feature if not in active use, and conduct a database access audit to identify any suspicious queries or exported data following plugin deployment.

Patch guidance

Install the latest patched version of WordPress Events Calendar from the official WordPress plugin repository or your hosting provider's plugin management interface. Before deploying to production, test the update in a staging environment to confirm compatibility with your site's configuration and any dependent themes or plugins. If you operate a multi-site WordPress network, apply updates to all affiliated sites. Review the vendor's changelog to confirm the specific patch addresses CWE-89 input validation issues in the Events Schedule module.

Detection guidance

Monitor database query logs for suspicious SQL patterns originating from authenticated sessions, particularly those containing UNION, SELECT, or comment sequences near Events Schedule functionality. Review access logs for subscriber-level accounts accessing event administration endpoints with high frequency or outside normal business hours. Inspect user activity reports for unusual data exports or bulk queries from the Events Calendar plugin. Enable WordPress security logging if available through your hosting provider or security plugins to capture authentication and database query anomalies.

Why prioritize this

This vulnerability merits urgent patching because it combines a high CVSS score (8.5), a well-understood attack vector (SQL injection), and straightforward exploitation requiring only subscriber credentials. The exposure of database contents could compromise customer trust, trigger regulatory compliance violations, and enable secondary attacks using disclosed information. While the requirement for authentication provides some mitigation, the prevalence of weak passwords and credential reuse in WordPress environments means this risk is material for most deployments.

Risk score, explained

The CVSS 3.1 score of 8.5 (HIGH) reflects high confidentiality impact (unrestricted database access via SQL injection), limited availability impact (not a full denial-of-service), and no integrity impact (read-only exploitation typical of SQL injection in this context). The network-accessible attack vector (AV:N), low attack complexity (AC:L), and low privilege requirement (PR:L) increase the score. The changed scope (S:C) indicates the vulnerability can affect resources or processes outside the vulnerable component, elevating severity. This is below CRITICAL (9.0+) only because integrity is not compromised and availability impact is limited, not universal.

Frequently asked questions