CVE-2026-9700

HighCVSS 7.5/10Last modified Jul 8, 2026

Description

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jul 8, 2026
Last modified
Jul 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-970017.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-970038.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-970048.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-970055.5Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.CVE-2026-970078.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-970088.8Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-970097.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-97019.8The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugCVE-2026-970108.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-970118.8Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-970128.8Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-970145.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2026-9700: High severity, CVSS 7.5 | Vulnix