CVE-2026-9711 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-9711 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-9711 is a SQL Injection vulnerability in the EventON WordPress Virtual Event Calendar Plugin, affecting all versions up to and including 5.0.11, exploitable via the WordPress search parameter.

Technical Detail

The flaw exists due to insufficient sanitization and escaping of user-supplied input passed through the search parameter before it is incorporated into SQL queries. An unauthenticated or low-privileged attacker can craft malicious search strings to manipulate the underlying database query, potentially enabling unauthorized data extraction, credential theft, or full database compromise. Depending on the server configuration and database user privileges, exploitation could extend to reading sensitive configuration data or writing malicious content to the database, which may facilitate further compromise of the WordPress installation.

Exploitation Status

No known exploit code has been publicly identified at this time. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Despite the absence of confirmed exploitation, the critical CVSS score of 9.8 and the unauthenticated attack surface make this a high-priority patching target, as SQL injection vulnerabilities in widely deployed WordPress plugins historically attract rapid weaponization once disclosed.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability as of July 07, 2026.

What To Do

Update the EventON WordPress Virtual Event Calendar Plugin to a version beyond 5.0.11 immediately. Site administrators should verify the installed version through the WordPress plugin dashboard and apply the latest available patch as the primary remediation step. If an update is not immediately available, consider temporarily deactivating the plugin to eliminate the attack surface until a patched release is confirmed. Web application firewall rules targeting SQL injection patterns in search parameters can provide a partial compensating control in the interim. Administrators should also audit database logs for anomalous query patterns that may indicate prior exploitation attempts, particularly any unexpected UNION, SELECT, or stacked query syntax originating from search-related endpoints.