CVE-2021-24943

CVE-2021-24943: Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL Injection

Vendor Unknown
Product Registrations for the Events Calendar – Event Registration Plugin
Weakness CWE-89 · SQLi
Published December 6, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.

Key dates

02Disclosure timeline

December 6, 2021 CVE published
August 3, 2024 Record updated