The Events Calendar Plugin CVE-2026-49772: Brief Summary of Critical Blind SQL Injection Affecting 700,000+ WordPress Sites

Introduction

A critical blind SQL injection vulnerability in The Events Calendar WordPress plugin puts over 700,000 active installations at risk of database compromise, and an attacker needs no credentials to exploit it. CVE-2026-49772 is the third SQL injection CVE in this plugin in under a year. It follows a pattern of incomplete fixes that points to deeper architectural issues in the plugin's database query layer.

The Events Calendar is one of the most widely used event management plugins for WordPress, with over 700,000 active installations and a history going back to January 2010. Nexcess maintains it under Liquid Web (it was formerly marketed under the StellarWP brand). Organizations of all sizes use it to manage and display events on their WordPress sites.

Technical Information

Vulnerability Classification and Scope

CVE-2026-49772 is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and falls within the OWASP Top 10 category A3: Injection. Patchstack assigned it a CVSS score of 9.3, which is in the critical severity range. The NVD record is currently in "Received" status, and NVD has not yet published its own CVSS vector breakdown.

The vulnerability affects The Events Calendar versions 6.15.12 through 6.16.2. That range begins after the patches for the two prior SQL injection CVEs (CVE-2025-9807, patched in 6.15.1.1, and CVE-2025-12197, patched in 6.15.10). So the vulnerability was either introduced or reintroduced in the 6.15.12 codebase rather than carried over from the earlier flaws.

Root Cause Analysis

The plugin's earlier CVEs say a lot about the likely root cause. Both CVE-2025-9807 (time-based SQL injection, versions up to 6.15.1) and CVE-2025-12197 (blind SQL injection, versions 6.15.1.1 through 6.15.9) exploited the 's' parameter (the search query parameter) in the plugin's custom query logic within src/Events/Custom_Tables/V1/WP_Query/Custom_Tables_Query.php. The core problem was that user input went into SQL queries without prepared statements and without sufficient escaping.

CVE-2025-12197 was explicitly described as a continuation of CVE-2025-9807. The remediation for the first flaw was incomplete and left the core vulnerability unresolved, so the same parameter could be exploited in a similar way in later versions. That is a clear pattern of point fixes that close specific injection vectors while leaving the underlying architectural weakness in how the plugin builds database queries in place.

The specific parameter and code path for CVE-2026-49772 have not been publicly detailed. Even so, the recurring pattern strongly suggests that the plugin's custom query construction in Custom_Tables_Query.php carries architectural debt that individual patches have not fully addressed.

Attack Vector and Exploitation Method

The vulnerability is unauthenticated, so any remote attacker can target an affected installation without WordPress credentials. That dramatically lowers the barrier to exploitation and makes automated scanning and mass exploitation feasible.

Because the injection is blind, the application does not return database errors or query results directly in its HTTP responses. Attackers have to infer data from indirect observations, using two main techniques:

Boolean-based blind SQL injection: The attacker builds payloads that ask the database true/false questions, and the application responds differently depending on whether the injected condition is true or false. By testing condition after condition, an attacker can extract data bit by bit. For example, an attacker might test whether the first character of the admin password hash is greater than a certain ASCII value and read the answer from the difference in the response.

Time-based blind SQL injection: The attacker injects database timing functions such as SLEEP() or BENCHMARK() in MySQL, so that a true condition delays the server response by the specified duration. By measuring response times, the attacker learns whether each condition holds and extracts data character by character. This technique is slower, but it works even when the application returns identical responses for true and false conditions.

Exploitation Flow

Based on what is known about this vulnerability and the related prior CVEs, the likely exploitation flow is:

1. The attacker identifies a WordPress site running a vulnerable version of The Events Calendar (versions 6.15.12 through 6.16.2). The version can be detected from publicly accessible plugin metadata.
2. The attacker sends a crafted request to the plugin's search or query endpoint, with SQL syntax injected into the vulnerable parameter.
3. Because the injection is blind, the attacker uses boolean-based or time-based inference to confirm that the injection point is exploitable.
4. With automated tooling such as sqlmap, which can fully automate blind SQL injection, the attacker extracts the database contents, including WordPress user credentials, site configuration data, and any other information stored in the database.
5. With admin credentials or other sensitive data in hand, the attacker can escalate to full site compromise and may deploy web shells or modify site content.

The Patchstack advisory states that the vulnerability "allows malicious actors to directly interact with the database to steal information."

Why This Matters at Scale

Patchstack assesses this vulnerability as "highly dangerous and expected to become exploited" and notes that "vulnerabilities like this one are used in mass exploit campaigns." Unauthenticated access, a 700,000+ installation base, and blind SQL injection that can be fully automated together favor large-scale exploitation. VulnCheck's State of Exploitation 2026 report noted that 28.96% of KEVs in 2025 were exploited on or before the day their CVE was published, which shows how quickly threat actors move on high-value vulnerabilities.

Affected Systems and Versions

Any WordPress site running The Events Calendar versions 6.15.12, 6.15.13, 6.16.0, 6.16.1, or 6.16.2 is vulnerable. Because the vulnerability is unauthenticated, any internet-facing installation in this version range is exposed, regardless of WordPress user configuration or role settings.

Version 6.16.3 is the patched release and is available from the WordPress plugin repository. The plugin was last updated on May 28, 2026. The WordPress.org changelog for 6.16.3 lists functional bug fixes and language updates and does not explicitly reference a security fix, which suggests the security patch shipped without a public changelog entry.

Vendor Security History

The Events Calendar has a concerning recent history of SQL injection vulnerabilities. The table below summarizes it:

Three SQL injection CVEs in under a year is a significant pattern. CVE-2025-12197 was explicitly caused by an incomplete fix for CVE-2025-9807, and the return of blind SQL injection in CVE-2026-49772 raises the question of whether the vendor's remediation process addresses root causes or only treats symptoms.

StellarWP has 122 published CVE records since 2019, and 10 of those CVEs have known public exploits. None have appeared in CISA's Known Exploited Vulnerabilities catalog.

Liquid Web also retired the StellarWP brand in May 2026 and consolidated its product portfolio. The Events Calendar is one of four core products that will continue to receive support. A small number of older themes and tools from the former StellarWP umbrella will receive critical security patches only through April 2027, with no support after that. The organizational disruption from this transition may affect security engineering capacity.

References

• NVD: CVE-2026-49772
• Patchstack Advisory: WordPress The Events Calendar Plugin 6.15.12 to 6.16.2 SQL Injection
• Patchstack VDP: The Events Calendar SQL Injection
• The Events Calendar on WordPress.org
• ZeroPath: CVE-2025-9807 Events Calendar SQL Injection Summary
• ZeroPath: CVE-2025-12197 Events Calendar Blind SQL Injection Summary
• Wordfence: The Events Calendar Vulnerability Database
• Wordfence: How To Find SQL Injection Vulnerabilities in WordPress Plugins
• StellarWP Vulnerability Overview (RadicalNotion)
• The Repository: Liquid Web Retires StellarWP
• CISA Known Exploited Vulnerabilities Catalog
• VulnCheck: State of Exploitation 2026
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command
• PortSwigger: What is Blind SQL Injection?