CVE-2024-8275

Summary

CVE-2024-8275 is a vulnerability affecting the The Events Calendar plugin for WordPress. This issue allows unauthenticated attackers to perform SQL Injection attacks by appending malicious queries to the 'order' parameter of the 'tribe_has_next_event' function. The vulnerability arises due to insufficient escaping of user-supplied data and inadequate query preparation. Consequently, sensitive information from the database can be extracted. However, it's important to note that only sites with manually added tribe_has_next_event() functions are vulnerable to this SQL injection attack.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.