CVE-2026-15023

Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta_key' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an attacker first plants SQL metacharacters in a custom meta key via the standard add-meta flow (WordPress stores these verbatim in wp_postmeta), then triggers the injection by invoking the event_duplicate or location_duplicate action, which reads the stored meta keys via get_post_meta() and concatenates them unsafely into the INSERT query.

We have discovered 24,735 live websites that are affected by CVE-2026-15023.

Run a Free Instant Scan



Affected Software

Product  Events Manager for WordPress
Category Wordpress Plugins
Vulnerable Domains24,735 live websites (70% of Events Manager for WordPress install base)
Vulnerable Versions
  • from 0 through 7.4
Vulnerable Versions Count106 versions ( 98% of all versions)


Common Weakness Enumeration

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')



Details

  • Published - Aug 25, 2026
  • Updated - Aug 25, 2026

Credits

  • Dmitrii Ignatyev (finder)

Website Distribution by Country

Number of websites using CVE-2026-15023
United States6,305 websites


Germany4,996 websites
France1,964 websites
Netherlands1,253 websites
GB1,227 websites
Italy1,159 websites
Switzerland696 websites
Canada601 websites
Japan562 websites
Spain532 websites

Website Distribution by TLD

Number of websites using CVE-2026-15023
.com6,095 websites
.de3,816 websites
.org3,302 websites
.nl1,166 websites
.fr985 websites
.it896 websites
.ch616 websites
.co.uk557 websites
.net510 websites
.at454 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-15023

Top websites that are affected by CVE-2026-15023. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**************.org Switzerland**,***
****.org United States**,***
*********.*******.org United States**,***
********.org United States**,***
*****.br Brazil**,***
****.org France**,***
*****.org United States**,***
***************.it Italy**,***
***********.*****.gov United States**,***
**********************.org France**,***
See full domain list

FAQ

CVE-2026-15023 is Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Events Manager for WordPress
A total of 24,735 websites have been identified as vulnerable to CVE-2026-15023, based on global website indexing conducted by WebTechSurvey.
The Events Manager for WordPress is affected by the CVE-2026-15023 vulnerability.
Events Manager for WordPress versions up to and including 7.4 are vulnerable to CVE-2026-15023.

References