CVE-2026-2429 is an SQL Injection vulnerability in the Community Events WordPress plugin by jackdewey, affecting all versions up to 1.5.8. The issue arises from insufficient escaping and lack of proper query preparation when handling the 'ce_venue_name' field in CSV uploads within the on_save_changes_venues function. This enables authenticated administrators to append malicious SQL queries to existing ones, potentially extracting sensitive data from the database. The vulnerability requires high privileges (Administrator) and does not involve user interaction beyond the CSV upload.

An attacker with Administrator-level access can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands via a crafted CSV file upload. The vulnerability does not affect data integrity or availability but compromises confidentiality. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and avoid uploading untrusted CSV files to the Community Events plugin. Monitor vendor channels for updates regarding patches or official mitigations.