CVE-2021-24943observed exploitationCWE-89

CVE-2021-24943: vulnerability in Registrations for the Events Calendar – Event…

Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL Injection

Published · Updated

Follow this CVE+ Monitor Registrations for the Events Calendar – Event Registration Plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

40Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 7.3%
from disclosure to weapon
Published on NVDDec 6
VulnCheckNov 8
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
Affected products
Unknown · Registrations for the Events Calendar – Event Registration Plugin
Related CVEs — Registrations for the Events Calendar – Event…

In the same product, most dangerous first.

CVE-2021-24876—Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site ScriptingEPSS 1.4%CVE-2021-25083—Registrations for the Events Calendar < 2.7.10 - Reflected Cross-Site ScriptingEPSS 0.9%