CVE-2026-15023: Events Manager WordPress Plugin SQLi Flaw

CVE-2026-15023 Overview

CVE-2026-15023 is a second-order SQL injection vulnerability in the Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress. The flaw affects all plugin versions up to and including 7.4.0. Authenticated users with contributor-level access or higher can inject SQL through the stored meta_key parameter. Attackers trigger the injection by invoking the event_duplicate or location_duplicate action, which reads stored meta keys via get_post_meta() and concatenates them unsafely into an INSERT query. Successful exploitation allows extraction of sensitive database contents, including user credentials and session tokens. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated contributors can extract arbitrary data from the WordPress database, including password hashes and secret keys, through second-order SQL injection.

Affected Products

Events Manager plugin for WordPress, all versions through 7.4.0
WordPress sites with contributor-level or higher user registration enabled
Sites using the Events Manager event or location duplication features

Discovery Timeline

2026-08-25 - CVE-2026-15023 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-15023

Vulnerability Analysis

The vulnerability is a stored, second-order SQL injection. The plugin trusts meta_key values retrieved from wp_postmeta and inserts them into a dynamically constructed INSERT statement without prepared statements or escaping. Because WordPress persists add_post_meta values verbatim, an attacker can plant SQL metacharacters in a custom meta key during normal post editing. The injection payload remains dormant until an authorized user or the attacker invokes the duplication action for an event or location.

When event_duplicate (see em-actions.php line 160) or location_duplicate (see em-actions.php line 316) fires, the plugin iterates through get_post_meta() results and builds an INSERT query. The concatenation occurs in em-event.php line 1720 and em-location.php line 613. The malicious meta_key breaks out of the intended query context.

Root Cause

The root cause is missing use of $wpdb->prepare() and missing escaping for identifier-like values retrieved from post meta. The code assumes meta keys are safe internal identifiers, but WordPress does not enforce character restrictions on meta_key values submitted through the standard meta editor.

Attack Vector

An attacker authenticated as a contributor performs the following sequence. First, the attacker creates or edits a post and uses the WordPress add-meta flow to store a custom meta key containing SQL syntax. The malicious value persists in wp_postmeta as raw text. Next, the attacker invokes the event_duplicate or location_duplicate action against a target event or location that carries the tainted meta. The plugin retrieves the stored meta key and concatenates it into the INSERT statement, executing attacker-controlled SQL against the WordPress database.

See the Wordfence Vulnerability Analysis for additional exploitation context.

Detection Methods for CVE-2026-15023

Indicators of Compromise

Rows in wp_postmeta where meta_key contains SQL metacharacters such as backticks, commas, parentheses, or the keywords SELECT, UNION, FROM, or INTO.
Web server access logs containing requests to admin.php or admin-post.php with action=event_duplicate or action=location_duplicate originating from contributor accounts.
Unexpected INSERT or SELECT queries in MySQL general or slow query logs referencing wp_em_events or wp_em_locations.
Sudden appearance of duplicated events or locations shortly after contributor account activity.

Detection Strategies

Query wp_postmeta for meta_key values that do not match a safe pattern such as ^[A-Za-z0-9_\-]+$ and review any matches for embedded SQL syntax.
Enable MySQL query logging on staging or high-value production sites and alert on queries containing multiple statement separators against Events Manager tables.
Correlate WordPress audit logs of add_post_meta events with subsequent event_duplicate or location_duplicate calls by the same user.

Monitoring Recommendations

Monitor for privilege changes and new contributor accounts on WordPress sites running the Events Manager plugin.
Alert on unexpected outbound traffic from the WordPress host that could indicate exfiltration of extracted database records.
Track file integrity of the events-manager plugin directory to detect tampering or backdoored versions.

How to Mitigate CVE-2026-15023

Immediate Actions Required

Update the Events Manager plugin to version 7.4.1 or later, which contains the fix per the plugin change log.
Audit wp_postmeta for suspicious meta_key entries on events and locations and remove any that contain SQL syntax.
Review contributor and author accounts for unauthorized or dormant users and reset credentials for privileged accounts.
Rotate WordPress secret keys in wp-config.php and force a password reset for administrators if compromise is suspected.

Patch Information

The vendor addressed the vulnerability in Events Manager 7.4.1. The fix introduces proper preparation of the INSERT statements referenced at em-event.php line 1720, em-event.php line 1727, em-location.php line 613, and em-location.php line 620. Administrators should apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Temporarily disable the Events Manager plugin on sites that cannot be patched immediately.
Restrict access to the duplicate actions by removing contributor and author capabilities that map to the affected endpoints until the patch is applied.
Deploy a web application firewall rule that blocks requests to event_duplicate and location_duplicate actions from non-administrator sessions.
Require administrator approval workflows for new contributor registrations to reduce the pool of accounts that can exploit the flaw.