CVE-2025-9807

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9807", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-01T15:12:12.036Z", "datePublished": "2025-09-12T01:46:00.820Z", "dateUpdated": "2026-04-08T17:06:25.893Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:25.893Z"}, "affected": [{"vendor": "stellarwp", "product": "The Events Calendar", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.15.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018s\u2019 parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea2ce90-6c8c-4a31-8faa-4ab99879d8b8?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.0.1/src/Events/Custom_Tables/V1/WP_Query/Custom_Tables_Query.php#L682"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "timeline": [{"time": "2025-08-26T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-09-01T15:27:49.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-11T12:26:47.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-12T14:35:26.766159Z", "id": "CVE-2025-9807", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T14:35:33.535Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9807", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-12T14:35:26.766159Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T14:35:30.635Z"}}], "cna": {"title": "The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "stellarwp", "product": "The Events Calendar", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.15.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-26T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-09-01T15:27:49.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-11T12:26:47.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea2ce90-6c8c-4a31-8faa-4ab99879d8b8?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.0.1/src/Events/Custom_Tables/V1/WP_Query/Custom_Tables_Query.php#L682"}], "descriptions": [{"lang": "en", "value": "The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018s\u2019 parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:25.893Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9807", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:06:25.893Z", "dateReserved": "2025-09-01T15:12:12.036Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-12T01:46:00.820Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "The Events Calendar", "vendor": "stellarwp", "versions": [{"lessThanOrEqual": "6.15.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018s\u2019 parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin The Events Calendar para WordPress es vulnerable a inyecci\u00f3n SQL basada en tiempo a trav\u00e9s del par\u00e1metro 's' en todas las versiones hasta, e incluyendo, la 6.15.1 debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes no autenticados a\u00f1adan consultas SQL adicionales en consultas ya existentes que pueden ser usadas para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-9807", "lastModified": "2026-09-26T00:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9807", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-12T14:35:26.766159Z", "version": "2.0.3"}}]}, "published": "2025-09-12T02:15:47.070", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.0.1/src/Events/Custom_Tables/V1/WP_Query/Custom_Tables_Query.php#L682"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea2ce90-6c8c-4a31-8faa-4ab99879d8b8?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:58:16.481756+00:00", "value": {"mitigation_remediation": ["Upgrade the Events Calendar plugin to the newest version (6.15.2 or later) which is presumed to contain the necessary escaping changes.", "Deploy or configure a Web Application Firewall rule to block or sanitize requests that try to inject SQL via the 's' parameter, mitigating the injection before it reaches the database.", "If an immediate upgrade is not feasible, disable or remove the plugin from the affected WordPress sites until a patch can be applied.", "Continuously monitor database logs and web traffic for suspicious query patterns that may indicate exploitation attempts."], "summary": {"action": "Patch urgently", "impact": "SQL injection leading to data leakage"}, "threat_synthesis": {"affected_systems": "The affected product is the WordPress plugin \"The Events Calendar\" developed by stellarwp. All bundled releases with version numbers up to and including 6.15.1 are vulnerable; later releases are presumed fixed based on the version boundary provided by the CNA.", "description_and_impact": "The vulnerability arises from the lack of escaping and preparation of the user\u2011supplied 's' parameter in the Events Calendar plugin, enabling a time\u2011based SQL injection. An attacker can append arbitrary SQL clauses to existing queries and retrieve sensitive data from the database, compromising confidentiality. The flaw does not allow remote code execution but does permit unauthorized disclosure of database contents.", "risk_and_exploitability": "The CVSS score of 7.5 marks the flaw as high severity, yet the EPSS score of less than 1\u202f% indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV, implying no known large\u2011scale exploitation campaigns. The likely attack vector is any HTTP request containing the 's' parameter, which does not require authentication. Without remediation, attackers could exfiltrate confidential database information."}}}}, "created": "2025-09-12T08:02:29.425875+00:00", "updated": "2026-04-21T03:00:06.382846+00:00", "vendors": ["theeventscalendar", "theeventscalendar$PRODUCT$the_events_calendar", "wordpress", "wordpress$PRODUCT$wordpress"]}