A vulnerability has been discovered in The Events Calendar WordPress plugin, one of the most widely used event management tools across WordPress sites. Tracked as CVE‑2025‑9807, this flaw allows unauthenticated attackers to perform time-based SQL injection attacks through improper handling of user input in a publicly accessible parameter. If exploited, it can lead to unauthorized data exfiltration directly from the underlying database without requiring user interaction, and most importantly, unauthenticated. 

Summary

Vulnerability: Time-based SQL Injection due to improper sanitization of user input.

CVE: CVE-2025-9807

Impact: Unauthenticated data exfiltration, potential for sensitive information disclosure, exploitation of database through time-based delays.

Affected Versions: The Events Calendar WordPress plugin versions up to and including 6.15.1.

Severity: High

Fix: The Events Calendar plugin has released a patched version (6.15.1.1) that properly sanitizes user inputs. Affected users should update to this version immediately.

How the attack works

The core of this vulnerability is a time-based SQL injection in The Events Calendar plugin for WordPress. The plugin uses a Custom_Tables_Query.php file to process event queries, including user-supplied input in the s parameter. This parameter is intended for simple search functionality, but due to insufficient input sanitization, it can be manipulated to modify the underlying SQL query.

An attacker can craft a specially designed request that injects SQL commands into the s parameter. By including database functions that introduce delays (e.g. the SLEEP function in MySQL), the attacker can measure the response time to infer if a condition is true or false. This time-based approach enables the attacker to extract information incrementally, without requiring direct access to query results.

Exploitation requires no authentication and can be executed against any publicly accessible WordPress site running a vulnerable version of the plugin. Attackers often automate this process using widely available SQL injection tools, which repeatedly send crafted requests and analyze response timings to reconstruct confidential data, including usernames, email addresses, and hashed passwords. Once an initial dataset is obtained, the attacker can leverage it for further attacks, such as account takeover, phishing campaigns, or lateral movement within connected systems.

What makes this so dangerous

This vulnerability combines several high-risk factors:

• Unauthenticated exploitation: The SQL injection can be triggered without any authentication, meaning attackers can target any vulnerable, internet-facing WordPress site directly.
• Direct access to sensitive information: The vulnerability allows attackers to retrieve usernames, email addresses, hashed passwords, and other confidential data, which can be leveraged for account takeover, phishing, or further network compromise.
• Ease of automation: Exploitation is straightforward to automate using scripts or open-source SQL injection tools, lowering the barrier for attackers and increasing the risk of large-scale attacks.

Mitigation steps and best practices

1. Update the plugin: The most effective mitigation is to update The Events Calendar plugin to version 6.15.1.1 or later, where the vulnerability has been patched. The update includes proper input validation and escaping of the s parameter, eliminating the time-based SQL injection vector.
2. Least privilege: Ensure that the database user used by WordPress has least-privilege access, restricting what can be read or modified in the event of a compromise.
3. Monitor for suspicious activity: Check web server and application logs for unusual requests containing SQL commands or repeated delayed-response patterns that may indicate exploitation attempts.
4. Additional layers of protection: Having a WAF in place might lower the success rate of attacks, but shouldn’t be relied upon to mitigate them entirely.

Zero day monitoring: Actively monitor for new vulnerabilities that can exploit internet-facing assets and build a rapid response process around it to shorten the window of exposure.

{{cta-demo}}