The Eventer WordPress plugin contains a SQL Injection vulnerability (CWE-564) due to improper handling of the reg_id parameter. Authenticated attackers with at least Subscriber privileges can append malicious SQL code to existing queries, exploiting insufficient input sanitization and lack of prepared statements. This vulnerability affects all versions up to and including 3.9.9.2 and has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers to execute arbitrary SQL commands within the database context, potentially leading to unauthorized data disclosure, modification, or deletion. The vulnerability affects the confidentiality, integrity, and availability of the affected WordPress site’s data. Attackers require authenticated access with Subscriber-level privileges or higher to exploit this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to the minimum necessary and monitor for suspicious activity involving the reg_id parameter. Avoid granting Subscriber or higher access to untrusted users. Follow the vendor’s updates closely for any released patches or official mitigations.