CVE-2026-9711 describes an SQL Injection vulnerability in the EventON (Pro) WordPress plugin up to version 5.0.11. The flaw is due to improper neutralization of special elements in the 'search' parameter, which is not properly escaped or prepared before being included in SQL queries. This allows unauthenticated attackers to inject additional SQL commands, potentially extracting sensitive database information. The vulnerability is contingent on the "Enable additional search queries" setting being active and the presence of at least one published event. The CVSS 3.1 score is 9.8 (critical), reflecting the network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is provided in the available data.

Successful exploitation can lead to unauthorized disclosure of sensitive database information, modification or deletion of data, and disruption of service. The vulnerability affects confidentiality, integrity, and availability of the affected WordPress plugin's data. Since the attack requires no authentication and no user interaction, it poses a critical risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable the "Enable additional search queries" setting to mitigate the risk. Monitor vendor channels for updates and apply patches promptly once available.