CyberRota Analysis
AI-GeneratedThe Events Manager plugin for WordPress versions prior to 7.4.1 is vulnerable to SQL injection due to inadequate sanitization of user-controlled input in SQL statements. This flaw allows users with subscriber-level access or higher to manipulate booking consent records belonging to other users, potentially leading to unauthorized data exposure or modification. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this security risk.
Original NVD Description
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.