imithemes Eventer Plugin up to 3.9.9.2 on WordPress sql injection

Summaryinfo

A vulnerability identified as critical has been detected in imithemes Eventer Plugin up to 3.9.9.2 on WordPress. This impacts an unknown function. Performing a manipulation results in sql injection. This vulnerability was named CVE-2025-0959. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in imithemes Eventer Plugin up to 3.9.9.2 on WordPress. It has been classified as critical. This affects some unknown functionality. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-564. Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and including, 3.9.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The weakness was presented by Lucio Sá. It is possible to read the advisory at wordfence.com. This vulnerability is uniquely identified as CVE-2025-0959 since 01/31/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/07/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• imithemes

Name

• Eventer Plugin

Version

• 3.9.9.0
• 3.9.9.1
• 3.9.9.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion