CVE-2025-10587 is a SQL Injection vulnerability in the Community Events WordPress plugin (jackdewey) affecting all versions up to 1.5.1. The issue stems from insufficient escaping and lack of prepared statements for the event_category parameter, which is user-supplied. Authenticated attackers with Subscriber-level privileges or higher can append additional SQL queries to the existing query, potentially extracting sensitive data from the database. The vulnerability is classified under CWE-89 and carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges required beyond subscriber, and high impact on confidentiality, integrity, and availability. No patch or remediation details are currently available from the vendor.

Successful exploitation allows authenticated users with Subscriber-level access or higher to perform SQL Injection attacks via the event_category parameter. This can result in unauthorized disclosure of sensitive database information, modification of database contents, and potential disruption of service. The vulnerability affects the confidentiality, integrity, and availability of the affected WordPress site’s data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level user privileges where possible and monitor for suspicious activity related to the Community Events plugin. Avoid using affected versions of the plugin if feasible.