---
id: "CVE-2026-93300"
kind: "vulnerability"
aliases: ["CVE-2026-93300"]
title: "EventON Subscriber WordPress plugin: unauthenticated SQL injection via email parameter"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["eventon", "package", "sql-injection", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "plugin-updated-past-1.4.5"]
published_at: "2026-10-20T06:16:57+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:22:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93300", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# EventON Subscriber WordPress plugin: unauthenticated SQL injection via email parameter

The EventON - Subscriber plugin for WordPress passes the 'email' parameter into SQL queries without proper escaping or preparation, in all versions up to and including 1.4.5. An unauthenticated attacker can append SQL to existing queries and extract sensitive data from the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the EventON - Subscriber plugin in the WordPress admin under Plugins; affected if it is `1.4.5` or older
- Confirm the plugin is active on the site

## Fix

- Update the EventON - Subscriber plugin to a version newer than `1.4.5` (the sources do not name the fixed version)
- If no fixed version is available, deactivate the plugin until one is

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93300

## From the sources

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_