CVE-2021-24943 | BDVDB-2026-165178 Detail

Registrations for the Events Calendar – Event Registration Plugin

Description#

The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

References#

https://wpscan.com/vulnerability/ba50c590-42ee-4523-8aa0-87ac644b77ed

Exploit#

No public exploit known

History#

Version 12021-12-06Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.