Unauthenticated SQL Injection in WordPress Eventer Plugin

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Eventer plugin for WordPress versions up to 4.4.2 contains a critical time-based SQL injection vulnerability in the 'code' parameter that allows unauthenticated attackers to inject malicious SQL queries. This vulnerability stems from insufficient input escaping and lack of prepared statement usage, enabling adversaries to extract sensitive database information without any authentication requirements. Any WordPress installation running the vulnerable Eventer plugin is at risk, making this a particularly dangerous flaw given WordPress's widespread adoption across millions of websites.

Casky.ai's 322 mapped security skills leverage Claude's extended reasoning to detect the attack patterns associated with TA0001 (Reconnaissance) and TA0043 (Reconnaissance) techniques by analyzing suspicious query timing patterns, unusual database access logs, and characteristic SQL injection payloads in web traffic and application logs. Practitioners using Casky would identify findings showing time-based SQL injection attempts through delayed HTTP responses, unexpected database queries with conditional delays (SLEEP, BENCHMARK functions), and parameters containing SQL syntax attempting to manipulate WHERE clauses. The platform's MITRE ATT&CK mapping would flag reconnaissance activities where attackers probe for database structure information, column names, and table contents—hallmark behaviors of SQL injection exploitation—allowing teams to correlate suspicious web requests with backend database anomalies and respond before data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-9700.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-9700

Casky has 322 skills that investigate the attack patterns behind CVE-2026-9700. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn