CVE-2024-11260 is a SQL Injection vulnerability in the Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin by netweblogic. The flaw exists in the active_status parameter, which is not properly escaped or prepared in SQL queries, enabling unauthenticated attackers to perform time-based SQL Injection attacks. This allows attackers to append malicious SQL commands to existing queries, potentially extracting sensitive data from the backend database. The vulnerability affects all versions up to and including 6.6.3. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. Since the attack requires no authentication and can be performed remotely, the risk is significant for affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable parameter or plugin, disable the plugin if not in use, or apply web application firewall (WAF) rules to detect and block SQL injection attempts targeting the active_status parameter.