CVE-2026-49772

CRITICAL LAB

WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-49772. PoCs published by joshuavanderpoll.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-49772, an unauthenticated blind SQL injection vulnerability in The Events Calendar WordPress plugin (versions 6.15.12 to 6.16.2). The exploit leverages an ORDER BY injection via the `order` parameter on the `/wp-json/tec/v1/events` endpoint, supporting both time-based and boolean-based techniques for data extraction.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.

Exploits (1)

github WORKING POC 1 stars

by joshuavanderpoll · pythonpoc

https://github.com/joshuavanderpoll/CVE-2026-49772

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2026-49772, an unauthenticated blind SQL injection vulnerability in The Events Calendar WordPress plugin (versions 6.15.12 to 6.16.2). The exploit leverages an ORDER BY injection via the `order` parameter on the `/wp-json/tec/v1/events` endpoint, supporting both time-based and boolean-based techniques for data extraction.

Classification

Working Poc 100%

Attack Type

Sqli

Complexity

Moderate

Reliability

Reliable

Target: The Events Calendar (WordPress plugin) 6.15.12 - 6.16.2

No auth needed

Prerequisites: Target must have The Events Calendar plugin installed and vulnerable version active · At least one event must exist in the WordPress database

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

mistral-large-3 · analyzed Jun 23, 2026 Full analysis →

References (1)

Core 1

Core References

Vdb Entry vdb-entry

https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-15-12-6-16-2-sql-injection-vulnerability?_s_id=cve

Scores

CVSS v3 9.3

EPSS 0.0031

EPSS Percentile 23.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Lab Environment

COMMUNITY

Community Lab

docker pull wordpress:6.7-php8.3-apache

docker pull wordpress:cli-php8.3

https://github.com/joshuavanderpoll/CVE-2026-49772

View in Library

Details

CWE

CWE-89

Status published

Products (1)

Liquid Web / StellarWP/The Events Calendar 6.15.12 - 6.16.2

Published Jun 16, 2026

Tracked Since Jun 16, 2026