CVE-2026-18057
Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.
| Vendor | unknown |
| Product | events manager |
| Published | Aug 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown events manager
Be the first to know when new unknown vulnerabilities affecting unknown events manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Events Manager
0 < 7.4.1
References
Credits
Jakub Herman WPScan