CVE-2024-8275 is a critical SQL Injection vulnerability (CWE-89) in the The Events Calendar plugin for WordPress, affecting all versions up to and including 6.6.4. The vulnerability arises from insufficient escaping and lack of proper preparation of the 'order' parameter in the 'tribe_has_next_event' function, enabling unauthenticated attackers to append malicious SQL queries. Only sites that have manually invoked tribe_has_next_event() are vulnerable. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the database confidentiality, integrity, and availability on affected sites that use the vulnerable function. Attackers can extract sensitive data or alter database contents without authentication. However, only sites that have manually added the tribe_has_next_event() function are at risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, sites should avoid using the tribe_has_next_event() function or implement custom input validation and sanitization on the 'order' parameter to mitigate injection risk. Monitor vendor channels for updates and apply patches promptly once available.