This vulnerability (CVE-2026-49772) in The Events Calendar plugin by Liquid Web / StellarWP is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. Specifically, it allows blind SQL injection, which can be exploited remotely without authentication or user interaction. The affected version explicitly identified is 6.15.12. The vulnerability can lead to high confidentiality impact by exposing sensitive data, with limited impact on integrity and availability. No vendor advisory or patch information is provided, and the remediation level is unknown.

An attacker can exploit this vulnerability remotely to perform blind SQL injection attacks, potentially extracting sensitive information from the backend database. The CVSS vector indicates no privileges or user interaction are required, increasing the risk of exploitation. The impact on confidentiality is high, while integrity is not affected and availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected plugin or applying temporary mitigations if recommended by the vendor.