CVE-2024-11135 is an SQL Injection vulnerability in the Eventer - WordPress Event & Booking Manager Plugin, affecting all versions up to 3.9.8. The vulnerability arises from improper neutralization of special elements in the 'event' parameter processed by the 'eventer_get_attendees' function. Due to insufficient escaping and lack of prepared statements, unauthenticated attackers can append malicious SQL queries to extract sensitive data from the backend database. The vulnerability is remotely exploitable without authentication or user interaction, with a CVSS 3.1 base score of 7.5 indicating high severity. No patch or official fix has been disclosed by the vendor as of the publication date.

Successful exploitation allows unauthenticated remote attackers to perform SQL Injection attacks, potentially extracting sensitive information from the plugin's database. The vulnerability does not impact integrity or availability but compromises confidentiality. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to vulnerable functionality. Applying web application firewall (WAF) rules to detect and block SQL Injection attempts targeting the 'event' parameter may provide temporary mitigation.