CVE-2026-49772: The Events Calendar SQL Injection Flaw

CVE-2026-49772 Overview

CVE-2026-49772 is a blind SQL injection vulnerability in the StellarWP The Events Calendar plugin for WordPress, maintained by Liquid Web. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. Affected versions span from 6.15.12 through 6.16.2. Unauthenticated attackers can exploit the issue over the network without user interaction, exposing site databases to data extraction through inferential queries. The vulnerability carries a CVSS 3.1 base score of 9.3 with a changed scope, indicating potential impact beyond the vulnerable component.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against WordPress sites running The Events Calendar 6.15.12 through 6.16.2, enabling extraction of sensitive database contents.

Affected Products

StellarWP / Liquid Web The Events Calendar plugin for WordPress
Versions 6.15.12 through 6.16.2
WordPress sites with the plugin enabled and reachable over HTTP/HTTPS

Discovery Timeline

2026-06-16 - CVE-2026-49772 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49772

Vulnerability Analysis

The Events Calendar processes user-controlled input that flows into an SQL statement without adequate sanitization or parameterization. Attackers manipulate the query through crafted request parameters and infer database contents from differences in response behavior, a class of blind SQL injection. Because the network attack vector requires no authentication or user interaction, the vulnerability is reachable from any client able to send HTTP requests to the WordPress site.

The changed scope component indicates that successful exploitation can affect resources beyond the vulnerable plugin, including data managed by the WordPress core and other plugins sharing the database. Confidentiality impact is high, while availability impact is limited. The EPSS exploit probability score is 0.236% with a percentile of 14.4, reflecting current observation data rather than the technical severity of the issue.

Root Cause

The plugin concatenates untrusted input into SQL queries without using prepared statements or properly escaping values through $wpdb->prepare(). This pattern allows attacker-supplied content to alter query structure rather than being treated strictly as data, classifying the defect under [CWE-89].

Attack Vector

An unauthenticated attacker sends crafted requests to a vulnerable endpoint exposed by The Events Calendar. By injecting boolean or time-based payloads, the attacker observes response timing or content variations to extract database rows character by character. Typical targets include the wp_users table, where password hashes and email addresses are stored, and the wp_options table containing site secrets.

No verified public exploit code is available at this time. Refer to the Patchstack SQL Injection Vulnerability advisory for further technical details.

Detection Methods for CVE-2026-49772

Indicators of Compromise

HTTP requests to The Events Calendar endpoints containing SQL meta-characters such as ', ", UNION, SLEEP(, BENCHMARK(, or -- in query parameters.
Unusual response time delays on plugin endpoints, consistent with time-based blind injection probing.
Sudden spikes in 500-class responses or repeated identical requests with incremented numeric values, characteristic of automated extraction.
New or modified WordPress administrator accounts following anomalous plugin traffic.

Detection Strategies

Inspect WordPress access logs for requests targeting The Events Calendar routes with embedded SQL syntax.
Enable WordPress database query logging temporarily and review for queries that contain attacker-controlled fragments outside expected WHERE clauses.
Deploy web application firewall (WAF) rules matching common SQLi signatures against plugin endpoints.
Correlate plugin version 6.15.12 through 6.16.2 presence with inbound request anomalies across managed WordPress fleets.

Monitoring Recommendations

Forward web server, PHP error, and WordPress audit logs to a centralized analytics platform for retention and search.
Alert on outbound traffic from the web host to unfamiliar destinations following suspected injection activity.
Monitor for changes to privileged database rows in wp_users and wp_usermeta after exposure windows.

How to Mitigate CVE-2026-49772

Immediate Actions Required

Update The Events Calendar to a fixed version above 6.16.2 as published by StellarWP.
Audit WordPress administrator accounts and rotate credentials, secret keys in wp-config.php, and API tokens stored in the database.
Restrict access to WordPress admin and plugin endpoints by IP allowlist where feasible until patching completes.
Review recent database query logs and access logs for indicators of exploitation predating the patch.

Patch Information

Refer to the Patchstack SQL Injection Vulnerability advisory for the vendor-supplied fixed version and upgrade instructions. Apply the update across all WordPress instances running the affected version range.

Workarounds

Temporarily deactivate The Events Calendar plugin on sites that cannot upgrade immediately.
Place a WAF in front of WordPress with SQL injection signature enforcement on requests to plugin endpoints.
Apply least-privilege to the WordPress database user, removing rights to FILE, CREATE USER, and cross-schema access where not required.

bash

# Example: identify affected plugin versions via WP-CLI across a fleet
wp plugin get the-events-calendar --field=version

# Disable the plugin on hosts pending patch deployment
wp plugin deactivate the-events-calendar