CVE-2026-13119 in Events Calendar Plugin
Summary
by MITRE • 07/23/2026
The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec_records_edit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $_POST['standard'] and uses the JSON array keys directly as column identifiers in the SET clause of an UPDATE statement built inside RTEC_Db_Admin::update_entry(). Only esc_sql() (mysqli_real_escape_string) is applied to the identifier; that function escapes quotes, backslashes, and a few control characters but does not escape spaces, equals signs, parentheses, or hyphens, so an attacker can break out of the identifier context and inject subqueries (terminated with a SQL comment). This makes it possible for authenticated attackers, with Contributor-level access and above who can edit the targeted event, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability in the Registrations For The Events Calendar WordPress plugin represents a critical SQL injection flaw that arises from improper input sanitization within the AJAX handler mechanism. This issue affects versions up to and including 3.2 where the rtec_records_edit AJAX action processes JSON data through the standard parameter. The core technical flaw occurs when the plugin decodes attacker-controlled JSON from $_POST['standard'] and directly utilizes the JSON array keys as column identifiers within an UPDATE statement's SET clause. The RTEC_Db_Admin::update_entry() function constructs SQL queries by concatenating these unescaped keys, creating a dangerous attack vector that allows authenticated users with Contributor-level privileges or higher to manipulate database operations.
The exploitation mechanism relies on the insufficient escaping provided by esc_sql() function which primarily handles quotes, backslashes, and control characters but fails to escape critical SQL metacharacters including spaces, equals signs, parentheses, and hyphens. This incomplete sanitization allows attackers to break out of the intended identifier context and inject malicious subqueries terminated with SQL comments. The vulnerability specifically targets the SET clause of UPDATE statements where column names are dynamically constructed from JSON keys without proper validation or escaping. Attackers can leverage this weakness to append additional SQL operations that may extract sensitive information from database tables, potentially compromising user credentials, event data, or other stored information.
The operational impact of this vulnerability extends beyond simple data theft as it provides authenticated attackers with persistent access to manipulate event records and potentially escalate their privileges within the WordPress environment. Since contributors and above can edit events, attackers can use this vulnerability to craft sophisticated attacks that combine multiple database operations, including data extraction, modification, or even deletion of critical event information. The flaw essentially allows malicious actors to execute unauthorized database queries against the plugin's tables, potentially leading to complete compromise of event registration data and associated user information stored within the WordPress database infrastructure.
Security mitigations for this vulnerability should focus on implementing proper input validation and escaping mechanisms that fully sanitize all identifiers used in dynamic SQL construction. The recommended approach involves using a whitelist of allowed column names or applying comprehensive escaping that addresses all SQL metacharacters rather than relying solely on esc_sql() which has known limitations. Organizations should immediately update to patched versions of the plugin, implement strict access controls limiting event editing privileges to trusted administrators only, and monitor database logs for suspicious activity patterns that may indicate exploitation attempts. Additionally, implementing proper parameterized queries or prepared statements would eliminate this class of vulnerability entirely while adhering to industry standards such as those outlined in CWE-89 for SQL injection prevention and ATT&CK techniques related to credential access through database exploitation.