CVE-2026-13119: WordPress Events Calendar Plugin SQLi Flaw

CVE-2026-13119 Overview

CVE-2026-13119 is a SQL Injection vulnerability [CWE-89] in the Registrations For The Events Calendar plugin for WordPress, affecting versions up to and including 3.2. The flaw resides in the rtec_records_edit AJAX action, which decodes attacker-controlled JSON from the standard POST parameter and uses the JSON keys directly as column identifiers in an UPDATE statement. Authenticated attackers with Contributor-level access who can edit the targeted event can append subqueries to extract sensitive database contents.

Critical Impact
Authenticated users with Contributor privileges can inject SQL subqueries and exfiltrate arbitrary data from the WordPress database.

Affected Products

Registrations For The Events Calendar plugin for WordPress
Versions up to and including 3.2
WordPress installations with the plugin active and users at Contributor role or above

Discovery Timeline

2026-07-23 - CVE-2026-13119 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-13119

Vulnerability Analysis

The vulnerability exists in RTEC_Db_Admin::update_entry(), invoked through the rtec_records_edit AJAX handler. The handler accepts a JSON payload in $_POST['standard'], decodes it, and iterates over the resulting associative array. The JSON keys are treated as trusted column names and concatenated into the SET clause of an UPDATE statement. Because attackers control the JSON structure, they control the raw identifier text placed into the SQL query.

The only sanitization applied to the identifier is esc_sql(), which wraps mysqli_real_escape_string. That function only escapes quotes, backslashes, and a small set of control characters. It does not escape spaces, equals signs, parentheses, or hyphens, all of which are needed to break out of a column identifier and pivot into an injected subquery terminated by a SQL comment.

Root Cause

The root cause is the use of an escape function intended for string literals to sanitize a SQL identifier. Identifiers require allow-list validation or backtick quoting with careful escaping, not string-literal escaping. Trusting attacker-supplied JSON keys as column names compounds the flaw and violates least-privilege data handling.

Attack Vector

An authenticated Contributor edits an event they control and submits a crafted request to the rtec_records_edit AJAX endpoint. The standard parameter contains a JSON object whose keys embed SQL fragments such as subqueries followed by a comment sequence. When update_entry() builds the UPDATE statement, the injected SQL becomes part of the executed query, enabling extraction of sensitive data such as user credentials, session tokens, and secret keys stored in the database.

No verified public exploit code is available. Technical details of the affected functions are documented in the WordPress plugin source at admin-functions.php L724 and class-rtec-db-admin.php L84.

Detection Methods for CVE-2026-13119

Indicators of Compromise

POST requests to admin-ajax.php with action=rtec_records_edit containing JSON payloads in the standard parameter that include SQL keywords such as SELECT, UNION, FROM, or --.
MySQL general log or slow log entries showing UPDATE statements against the plugin's entries table with unexpected subqueries in the SET clause.
Unexplained reads from wp_users or wp_usermeta originating from AJAX-triggered queries.

Detection Strategies

Inspect web server access logs for authenticated users repeatedly invoking the rtec_records_edit action with large or malformed standard payloads.
Enable MySQL query logging on staging systems and alert on UPDATE statements whose column identifiers contain whitespace, parentheses, or the -- comment sequence.
Deploy a Web Application Firewall (WAF) rule that inspects JSON keys within POST bodies for SQL metacharacters when targeting WordPress admin endpoints.

Monitoring Recommendations

Audit WordPress user roles and remove Contributor or higher privileges from accounts that do not require them.
Monitor for privilege changes and new event creation activity that correlates with AJAX calls to the plugin.
Forward WordPress and web server logs to a centralized analytics platform for correlation across authentication and query anomalies.

How to Mitigate CVE-2026-13119

Immediate Actions Required

Update the Registrations For The Events Calendar plugin to a version later than 3.2 as soon as the vendor publishes a fix.
Restrict Contributor and higher roles to trusted users only, and review recently registered accounts.
Disable the plugin on affected sites until a patched release is installed if untrusted contributors exist.

Patch Information

The vendor released a fix through the WordPress plugin repository. Review the code changes in the WordPress plugin changeset 3599275 and the Wordfence Vulnerability Report for remediation guidance.

Workarounds

Deploy a WAF rule blocking POST requests to admin-ajax.php where action=rtec_records_edit and the standard parameter contains SQL comment markers or subquery syntax.
Temporarily revoke event-edit capability from Contributor accounts by adjusting WordPress role definitions.
Restrict /wp-admin/admin-ajax.php access by IP allow-list for administrative networks where feasible.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns in the standard parameter
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026013119,\
   msg:'CVE-2026-13119 SQLi attempt in rtec_records_edit'"
  SecRule ARGS:action "@streq rtec_records_edit" "chain"
    SecRule ARGS:standard "@rx (?i)(select|union|--|/\*|\(|\))" "t:none,t:urlDecodeUni"