CVE-2026-18057 — Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber accou…
Published: 2026-08-12 · CVSS: 8.1 · CVSS 3.1
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7