CVE-2026-18057 in Events Manager Plugin

Summary

by MITRE • 08/12/2026

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsible: WPScan
• Reservation: 07/28/2026
• Disclosure: 08/12/2026
• Moderation: accepted
• Entry: VDB-388954
• CPE: ready
• CWE: CWE-89 (confirmed)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: very low
• Sector: Hostingprovider

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-18057
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18057
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-18057/