{"id":"CVE-2026-93300","kind":"vulnerability","aliases":["CVE-2026-93300"],"related":[],"title":"EventON Subscriber WordPress plugin: unauthenticated SQL injection via email parameter","description":"The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","summary":"The EventON - Subscriber plugin for WordPress passes the 'email' parameter into SQL queries without proper escaping or preparation, in all versions up to and including 1.4.5. An unauthenticated attacker can append SQL to existing queries and extract sensitive data from the site's database.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eventon","package","sql-injection","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","plugin-updated-past-1.4.5"],"how_to_check":"- Check the installed version of the EventON - Subscriber plugin in the WordPress admin under Plugins; affected if it is `1.4.5` or older\n- Confirm the plugin is active on the site","fix":"- Update the EventON - Subscriber plugin to a version newer than `1.4.5` (the sources do not name the fixed version)\n- If no fixed version is available, deactivate the plugin until one is","status":"open","published_at":"2026-10-20T06:16:57+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:22:50+00:00","updated_at":"2026-10-25T03:22:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:22:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update the EventON - Subscriber plugin to a version newer than `1.4.5` (the sources do not name the fixed version)\n- If no fixed version is available, deactivate the plugin until one is","reach":"internet","title":"EventON Subscriber WordPress plugin: unauthenticated SQL injection via email parameter","impact":"high","summary":"The EventON - Subscriber plugin for WordPress passes the 'email' parameter into SQL queries without proper escaping or preparation, in all versions up to and including 1.4.5. An unauthenticated attacker can append SQL to existing queries and extract sensitive data from the site's database.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","eventon","sql-injection"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attackers read sensitive database contents, including user data","analyst_note":"Find the fixed plugin version and the vendor advisory; the NVD entry does not name a patched release.","how_to_check":"- Check the installed version of the EventON - Subscriber plugin in the WordPress admin under Plugins; affected if it is `1.4.5` or older\n- Confirm the plugin is active on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated-past-1.4.5"],"who_is_affected":"Sites running the EventON - Subscriber plugin at version 1.4.5 or older with the plugin active. The sources do not describe which plugin settings or pages must be enabled, so any active install should be treated as exposed. Sites that do not run this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000637,"input_tokens":3367,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-93300':13A,16A '1.4.5':51B,93C 'addit':122C 'alreadi':126C 'append':56B,121C 'attack':54B,119C 'cve':11A,14A 'data':64B 'databas':69B,139C 'due':94C 'email':9A,34B,84C 'escap':41B,97C 'eventon':1A,17B,27B,71C 'exist':59B,110C,127C 'extract':62B,134C 'generic':79C 'includ':50B,92C 'inform':136C 'inject':7A,21B,81C 'insuffici':96C 'lack':104C 'make':114C 'packag':18B 'paramet':10A,35B,85C,102C 'pass':32B 'plugin':4A,25B,29B,73C 'possibl':116C 'prepar':43B,107C 'proper':40B 'queri':38B,60B,112C,124C,128C 'sensit':63B,135C 'site':67B 'sql':6A,20B,37B,57B,80C,111C,123C 'sql-inject':19B 'subscrib':2A,28B,72C 'suffici':106C 'suppli':101C 'unauthent':5A,53B,118C 'use':132C 'user':100C 'version':46B,88C 'via':8A,82C 'vulner':77C 'without':39B 'wordpress':3A,22B,24B,31B,75C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the EventON - Subscriber plugin at version 1.4.5 or older with the plugin active. The sources do not describe which plugin settings or pages must be enabled, so any active install should be treated as exposed. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T06:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93300","severity":null,"published_at":"2026-10-20T06:16:57+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}