CVE-2026-9700 is a SQL Injection vulnerability in the Eventer WordPress plugin (joe007) affecting versions up to 4.4.2. The flaw arises from improper neutralization of special elements in the 'code' parameter, enabling unauthenticated attackers to perform time-based SQL Injection attacks. This is due to insufficient escaping of user input and lack of prepared statements in the SQL query construction. The vulnerability allows attackers to append malicious SQL commands to existing queries, potentially extracting sensitive information from the backend database. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information stored in the database. The vulnerability does not impact integrity or availability according to the CVSS vector. Since the attack requires no authentication and no user interaction, it poses a significant risk to affected installations. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Eventer plugin or restricting access to vulnerable endpoints to trusted users only. Avoid exposing the vulnerable parameter to untrusted inputs. Monitor vendor channels for updates and apply patches promptly once available.