CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roundup WP Registrations for the Events Calendar allows SQL Injection.This issue affects Registrations for the Events Calendar: from n/a through 2.12.2.
Explanation of Vulnerability in Simple Terms
Registrations for the Events Calendar versions up to 2.12.2 contain a SQL injection vulnerability in database queries. An attacker with low-level site access can craft malicious input to read or modify database records. The vulnerability affects confidentiality and availability of the site's data.
What an attacker can do
Read or modify database records by injecting SQL commands through the plugin.
Potential impact on your site
Unauthorized access to event registrations, attendee data, and potential data modification or deletion.
Conditions required to exploit
Attacker must have a low-privilege account (e.g., subscriber or contributor role) on the site.
Key dates
External resources
Related vulnerabilities
