CVE-2024-8275: The Events Calendar WordPress plugin SQL injection via order parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS score is critical (9.8) and EPSS is high, but exploitation is limited to sites that manually added the vulnerable function, reducing overall risk.

What it is

The Events Calendar plugin for WordPress is vulnerable to SQL injection through the 'order' parameter of the tribe_has_next_event() function in versions up to and including 6.6.4. The flaw stems from insufficient escaping of user input and inadequate query preparation, allowing unauthenticated attackers to inject SQL. It matters because successful exploitation can expose sensitive database contents, though only sites that have manually added tribe_has_next_event() are affected.

Impact

An attacker can append arbitrary SQL queries to existing queries, enabling extraction of sensitive information from the WordPress database. This could include user credentials, configuration data, or other stored secrets.

Attack surface

The vulnerability is reachable over the network via the 'order' parameter without authentication or user interaction, as reflected in the CVSS vector AV:N/AC:L/PR:N/UI:N. However, exploitation requires the site to have manually added the tribe_has_next_event() function, limiting the attack surface to a subset of installations.

Exploitation

The vulnerability is not listed in CISA KEV, but EPSS indicates a high probability of exploitation (0.49914, 98.8th percentile). A patch reference is available, and no ransomware groups are documented as using it.

What to do

• Update The Events Calendar plugin to a version later than 6.6.4 as soon as possible.
• If the tribe_has_next_event() function was manually added, remove or disable it until patched.
• Apply input validation and parameterized queries if custom code calls tribe_has_next_event().
• Monitor for and restrict unnecessary database query exposure from custom template functions.
• Review WordPress database activity for anomalous SQL patterns.

Detection

• Inspect web server logs for requests containing suspicious 'order' parameter values, such as SQL keywords or comment sequences.
• Enable and review database query logging for unexpected UNION, SELECT, or stacked queries originating from WordPress.
• Use a web application firewall (WAF) to alert on SQL injection patterns targeting the 'order' parameter.
• Audit custom theme or plugin code for calls to tribe_has_next_event() and ensure they are removed or secured.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.