CVE-2026-9711 describes an SQL Injection vulnerability in the EventON (Pro) WordPress plugin, specifically affecting versions up to and including 5.0.11. The issue stems from improper neutralization of special elements in the 'search' parameter, allowing unauthenticated attackers to inject arbitrary SQL commands. This is due to insufficient escaping and the absence of prepared statements in the plugin's SQL query construction. The vulnerability requires the plugin setting "Enable additional search queries" to be active and at least one published event present. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized disclosure of sensitive database information, modification of database contents, and potential denial of service. Since the vulnerability is exploitable by unauthenticated attackers remotely without user interaction, it poses a critical risk to affected systems. The impact includes full compromise of the plugin's database data confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable the "Enable additional search queries" setting to prevent exploitation. Monitor the vendor's communications for updates and apply any official patches promptly once available.