CVE-2026-15023

Executive Summary

CVE-2026-15023 is a second-order SQL injection vulnerability in the Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin, affecting all versions up to and including 7.4.0. The flaw exists in the Event/Location Duplicate Action functionality, where stored custom meta keys are concatenated unsafely into SQL queries without sufficient escaping or preparation. Authenticated attackers with contributor-level access or above can exploit this vulnerability to extract sensitive information from the WordPress database, including user credentials, password hashes, and other confidential data. The vulnerability has a CVSS score of 6.5 (High) and, as of this report, no patch has been released by the vendor.

Technical Analysis

The vulnerability is classified as CWE-89 (SQL Injection) and manifests as a second-order injection within the plugin's event and location duplication functionality. The attack mechanism leverages the WordPress native meta-key storage system (wp_postmeta table), which stores custom metadata verbatim without sanitization.

The vulnerability chain operates as follows:

1. Meta-Key Injection Vector: WordPress allows authenticated users with contributor-level access to add custom meta keys to posts, events, and locations through the standard metadata creation flow. The platform stores these custom keys in the wp_postmeta table without filtering or escaping the key name itself. An attacker can therefore plant SQL metacharacters (e.g., single quotes, comments, and stacking operators) within a custom meta key name.

2. Injection Trigger: The plugin's Event/Location Duplicate Action reads stored meta keys via get_post_meta() when duplicating an event or a location. The plugin then constructs an SQL INSERT query to copy the metadata to the newly duplicated entry. Critically, the plugin concatenates these stored meta keys into the SQL query string without parameterized preparation or sufficient escaping of the user-supplied meta key data.

3. Second-Order Execution: The injection is "second-order" because the malicious payload is stored in the database during the first interaction (meta key creation) and is only executed when the plugin later retrieves and uses that data during the duplicate action. An attacker does not need to inject the payload at the time of the SQL query execution—they plant it earlier through the legitimate metadata-add flow.

4. Query Manipulation: The lack of prepare() or proper parameterization on the concatenated meta key allows attackers to break out of the intended query structure. Because the attacker can use stacking operators (e.g., semicolon-separated queries), they can append additional SQL statements to the existing INSERT query. These appended queries can be crafted to extract sensitive data from other database tables, such as the wp_users table (containing usernames and password hashes), wp_options (site configuration), and other custom tables.

5. Privilege Considerations: The vulnerability requires only contributor-level access, which is the lowest role that can author content in WordPress. Contributors cannot typically publish content directly (that requires editor/admin review), but they can create drafts and add meta keys. This low access requirement significantly broadens the attack surface, as membership sites and community-driven WordPress installations commonly have multiple contributor accounts.

The key weakness is twofold: (a) insufficient escaping of the user-supplied meta key parameter at the point of storage or retrieval, and (b) lack of parameterized preparation on the existing SQL query that incorporates these values. The absence of either defensive control would be sufficient to block this attack vector.

Exploitation Scenarios

The attack chain for CVE-2026-15023 follows a distinct multi-stage pattern. No public PoC or exploit code is currently available; the attack chain below is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance and Target Identification: The attacker identifies WordPress sites running the Events Manager plugin version 7.4.0 or earlier. They can fingerprint the plugin by checking page source code for wp-content/plugins/events-manager paths, examining site headers, or using Shodan/Censys dorks to find publicly indexed installations. The attacker also confirms they have contributor-level credentials on the target (or compromises such an account via credential stuffing, phishing, or other means).

Step 2 — Payload Planting: With contributor access, the attacker creates a new event or location (or opens an existing draft) and proceeds to add a custom meta key through the standard WordPress/plugin add-meta flow. The meta key itself contains SQL injection payload characters—for example, a key such as evil_key'); DROP TABLE wp_options; -- or test_key'); SELECT user_login, user_pass FROM wp_users; --. The WordPress platform stores this verbatim in wp_postmeta without sanitization. The attacker also populates a corresponding meta value (necessary for the plugin to process the key during duplication).

Step 3 — Injection Trigger: The attacker selects the event or location that contains the poisoned meta key and invokes the Event/Location Duplicate Action (the event_duplicate or location_duplicate action). The plugin reads all meta keys associated with the original entity via get_post_meta(), retrieves the malicious key from storage, and concatenates it directly into the SQL INSERT query used to copy metadata to the new duplicate entity.

Step 4 — Query Manipulation and Data Exfiltration: The unescaped meta key breaks the SQL query structure. The attacker's chained SQL statements execute sequentially against the database. A typical exfiltration payload would use UNION SELECT or stacked queries to dump user_login and user_pass columns from the wp_users table, copying sensitive data into response-accessible locations (e.g., inserting credentials into the new duplicate event's meta values that the attacker can then view in the WordPress admin dashboard). Alternatively, the attacker could use error-based techniques to trigger verbose database errors that leak data, or time-based blind injection (SLEEP() functions) paired with Boolean logic to extract data character-by-character.

Post-Exploitation Impact: Successful exploitation yields the WordPress database contents, exposing user credentials (password hashes), site configuration, active sessions, and any plugin-specific sensitive data (event bookings, attendee personal information, payment records, etc.). The attacker can use harvested admin password hashes for offline cracking (common weak hashes like MD5 can be cracked quickly) and then escalate to full WordPress administrator access, potentially leading to plugin installation, remote code execution via theme/plugin file edits, and full server compromise.

Alternative Scenario: In environments where stacked queries are not supported by the database adapter (e.g., restricted MySQL configurations), the attacker can still use UNION-based injection to manipulate the INSERT query's data source, forcing the query to return data from arbitrary tables into the destination columns—data that is then rendered in the duplicated entity's admin view for extraction.

Impact Assessment

The vulnerability carries a CVSS score of 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a High severity rating. The high confidentiality impact is the primary concern—SQL injection enabling full database read access can expose:

• Credential Data: WordPress wp_users table contains user logins and password hashes. Compromising admin credentials leads to complete site takeover.
• User PII: The Events Manager plugin stores attendee/booking information, including names, emails, phone numbers, and potentially payment metadata—exposing the site owner to regulatory penalties (GDPR, CCPA).
• Site Secrets: The wp_options table stores encryption keys (AUTH_KEY, SECURE_AUTH_KEY), database credentials, and API tokens that enable deeper infrastructure compromise.
• Business Data: Event schedules, customer contact lists, booking histories, and financial records can be monetized or leaked externally.

Affected Systems: All WordPress installations running Events Manager plugin versions up to and including 7.4.0. Given that the plugin is distributed through the official WordPress plugin repository and used primarily for event-based businesses (conferences, venues, ticketing platforms), the real-world installed base is significant.

Blast Radius: The attack surface includes every site with at least one contributor-level account. Multisite WordPress installations and community-driven sites with many low-privileged authors are at the highest risk. Since the plugin is managed by a single vendor with no disclosed patch path, affected sites remain indefinitely exposed until a fix is released or the plugin is removed/disabled.

Integrity and Availability: The CVSS vector shows no integrity or availability impact (I:N/A:N), but this is conservative. Skilled attackers could potentially escalate SQL injection to write operations (e.g., inserting malicious data, updating admin email addresses) depending on database user permissions. Additionally, the confidentiality breach alone is often sufficient to chain into full compromise.

Detection Guidance

The following detection content assumes the attacker plants malicious meta keys and triggers the duplication action. Log sources include WordPress debug logs, database query logs, web server access logs, and WAF/IDS telemetry.

Sigma Rule

title: Wordpress Events Manager Plugin SQL Injection - Meta Key Duplication
id: 6a8c3f2e-9d41-4b7e-a1c5-3f8d2e9a7b41
status: experimental
description: Detects SQL injection attempts against the Events Manager plugin via malicious meta_key values stored and used during event/location duplication actions
author: Valters IT Security Research
logsource:
    category: webserver
    product: apache
    definition: Web server access logs or HTTP request logs
detection:
    selection_duplicate:
        cs-method: POST
        cs-uri-query|contains:
            - 'action=event_duplicate'
            - 'action=location_duplicate'
        cs-uri-query|re: 'meta_key.*[''";\\]'
    selection_injection_patterns:
        cs-uri-query|contains:
            - 'UNION'
            - 'SELECT'
            - 'SLEEP'
            - 'BENCHMARK'
            - 'INFORMATION_SCHEMA'
            - '--'
            - '/*'
            - ';'
    condition: selection_duplicate and selection_injection_patterns
falsepositives:
    - Legitimate use of special characters in meta keys by site administrators (unlikely)
    - Automated scanners generating similar patterns
level: high

YARA Rule

rule WordPress_Events_Manager_SQLi_MetaKey
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects SQL injection patterns in WordPress Events Manager meta_key values used in duplication actions"
        cve = "CVE-2026-15023"
        date = "2026-05-15"
        severity = "high"
    strings:
        $sqli_func1 = "UNION" ascii nocase
        $sqli_func2 = "SELECT" ascii nocase
        $sqli_func3 = "SLEEP(" ascii nocase
        $sqli_func4 = "BENCHMARK(" ascii nocase
        $sqli_func5 = "INFORMATION_SCHEMA" ascii nocase
        $sqli_meta = "meta_key" ascii nocase
        $sqli_dup1 = "event_duplicate" ascii nocase
        $sqli_dup2 = "location_duplicate" ascii nocase
        $sqli_quote = "'" ascii
        $sqli_semis = ";" ascii
        $sqli_dashes = "--" ascii
    condition:
        ($sqli_dup1 or $sqli_dup2) and $sqli_meta and
        (
            ($sqli_func1 and $sqli_func2) or
            $sqli_func3 or $sqli_func4 or $sqli_func5
        ) and
        ($sqli_quote or $sqli_semis or $sqli_dashes)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS WordPress Events Manager plugin SQL Injection via meta_key in duplicate action (CVE-2026-15023)"; flow:established,to_server; content:"POST"; http_method; content:"action=event_duplicate"; http_uri; nocase; content:"meta_key"; http_uri; nocase; pcre:"/meta_key[^&]*(UNION|SELECT|SLEEP|BENCHMARK|INFORMATION_SCHEMA|['\";--])/i"; reference:cve,2026-15023; classtype:web-application-attack; sid:2026150231; rev:1; metadata:created_at 2026-05-15, updated_at 2026-05-15;)

Elastic Detection

// Detect HTTP requests containing SQL injection markers targeting Events Manager duplicate actions
sequence by source.ip
  with maxspan=5m
  [network where event.category == "web" and request.method == "POST" and
   contains(request.uri, "action=event_duplicate") or contains(request.uri, "action=location_duplicate")]
  [network where event.category == "web" and
   wildcard(request.body, "*meta_key*") and
   (contains(request.body, "UNION") or contains(request.body, "SELECT") or
    contains(request.body, "SLEEP") or contains(request.body, "INFORMATION_SCHEMA"))]

// Detect anomalous database query activity indicative of SQL injection
sequence by host.id with maxspan=10m
  [process where event.action == "command" and
   process.args : "*wp_postmeta*" and process.args : "*SELECT*"]
  [process where event.action == "command" and
   process.args : "*event_duplicate*" or process.args == "*location_duplicate*"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| where method="POST"
| eval uri_lower=lower(uri)
| search (uri_lower="*action=event_duplicate*" OR uri_lower="*action=location_duplicate*")
| search uri_lower IN ("*union*", "*select*", "*sleep*", "*benchmark*", "*information_schema*")
   OR form_data IN ("*meta_key*union*", "*meta_key*select*", "*meta_key*';*", "*meta_key*--*")
| eval sqli_detected=if(match(uri,"(?i)(UNION|SELECT|SLEEP|BENCHMARK|INFORMATION_SCHEMA|\\x27|--|;\\s*$)"),"yes","no")
| where sqli_detected="yes"
| table _time, src_ip, dest_host, uri, form_data, user_agent
| sort - _time

Wazuh OSSEC Rule

<group name="web_application_attacks,">
    <rule id="546508" level="12">
        <decoded>event_duplicate</decoded>
        <regex>meta_key.*(UNION|SELECT|SLEEP|BENCHMARK|INFORMATION_SCHEMA|[;'--])</regex>
        <description>WordPress Events Manager SQL Injection attempt via meta_key in event duplicate action (CVE-2026-15023)</description>
        <group>attack,reconnaissance,sql_injection,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
    <rule id="546509" level="12">
        <decoded>location_duplicate</decoded>
        <regex>meta_key.*(UNION|SELECT|SLEEP|BENCHMARK|INFORMATION_SCHEMA|[;'--])</regex>
        <description>WordPress Events Manager SQL Injection attempt via meta_key in location duplicate action (CVE-2026-15023)</description>
        <group>attack,reconnaissance,sql_injection,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

At the time of this report, no vendor patch is available. All versions of the Events Manager plugin up to and including 7.4.0 are vulnerable. The following measures should be implemented immediately:

1. Immediate Mitigations (implement now)

• Restrict Contributor Accounts: Temporarily disable or reduce all contributor-level accounts to subscriber (read-only) roles until a patch is available. If the plugin's duplicate functionality is not used by your organization, consider removing contributor roles entirely or restricting them to trusted personnel only.
• Disable or Remove the Plugin: If the Events Manager plugin is not mission-critical, deactivate and uninstall it entirely. The plugin's functionality should be assessed to determine if alternative event management solutions are viable.
• Apply WAF Rules: Deploy or update Web Application Firewall (WAF) rules to block requests containing suspicious meta_key patterns combined with event_duplicate or location_duplicate actions. The detection rules above can serve as WAF logic.
• Database Hardening: Restrict the WordPress database user's privileges to the minimum required (e.g., SELECT, INSERT, UPDATE, DELETE only on the WordPress database, no FILE privilege, no GRANT OPTION). This limits what an attacker can accomplish even if SQL injection succeeds.
• Monitor and Audit: Immediately review database query logs and access logs for indicators of exploitation. Audit all meta keys in wp_postmeta for suspicious characters (quotes, semicolons, SQL keywords) and remove any flagged entries.

2. Patch/Upgrade Steps

• Monitor Plugin Updates: Watch the WordPress plugin repository for the Events Manager plugin updates. The vendor is expected to release a patched version that includes proper prepare() statements and escaping for meta key values. Update to the patched version (which will be announced as > 7.4.0) as soon as it is released.
• Subscribe to Security Advisories: Register for updates from the plugin vendor's website and relevant security mailing lists (e.g., WPScan, Wordfence) to receive immediate notification of patch availability.
• Test Before Deploying: Before applying any patch to production, test in a staging environment that replicates your site's configuration and plugin set to verify no regression of events-management functionality.

3. Long-Term Hardening

• Principle of Least Privilege: Enforce strict role separation. No contributor-level account should be granted to untrusted or external parties. Conduct regular user access reviews to remove dormant accounts.
• Web Application Firewall (WAF): Deploy or maintain a WAF such as Cloudflare, AWS WAF, or ModSecurity with WordPress-specific rulesets that block SQL injection patterns at the perimeter. Configure rules to block POST requests with stacked query indicators.
• Database Security: For MySQL/MariaDB installations, set sql_mode to include STRICT_ALL_TABLES and NO_BACKSLASH_ESCAPES where compatible with the application. This makes injection harder to execute silently. Use parameterized queries throughout the application stack.
• WordPress Hardening: Disable file editing from the admin dashboard (define('DISALLOW_FILE_EDIT', true);), enforce strong password policies, and implement two-factor authentication for all admin and editor accounts.
• Regular Penetration Testing: Include the Events Manager plugin in quarterly penetration tests and vulnerability scans, targeting the metadata and duplication workflows.
• Backup and Recovery: Maintain current, tested backups of the database so that in the event of data exfiltration or corruption, recovery can be performed quickly.
• Log Correlation: Implement centralized logging (SIEM) with the detection rules above so that exploitation attempts are flagged and correlated across multiple sites.

References

1. NVD Entry — CVE-2026-15023: https://nvd.nist.gov/vuln/detail/CVE-2026-15023 (National Vulnerability Database — official CVE metadata, CVSS 6.5 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
2. WordPress Plugin Repository — Events Manager: https://wordpress.org/plugins/events-manager/ (Plugin listing; monitor for version updates addressing this vulnerability)
3. WPScan Vulnerability Database — CVE-2026-15023: https://wpscan.com/vulnerability/ (Register for notification; WPScan typically lists WordPress plugin vulnerabilities with patches and workarounds)
4. MITRE ATT&CK — T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ (Tactic: Initial Access; technique mapping for this vulnerability)
5. OWASP SQL Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html (Mitigation guidance: parameterized queries, escaping, and privilege minimization)

Threat Actor Intelligence: No threat actor campaigns, exploit-in-the-wild activity, or public proof-of-concept exploits have been identified for CVE-2026-15023 at the time of this writing. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. The absence of a patch combined with the low-privilege exploitation requirement makes this vulnerability a strong candidate for future weaponization by automated botnets and opportunistic attackers; organizations using the affected plugin should treat this as a high-priority remediation target despite the lack of observed exploitation.