CVE-2024-8275

CVE-2024-8275 is a critical SQL injection (CWE-89) in The Events Calendar WordPress plugin from StellarWP, caused by insufficient escaping of the user-supplied 'order' parameter in the tribe_has_next_event() function and inadequate preparation of the underlying SQL query. An unauthenticated attacker can append additional SQL queries to existing ones over the network without any privileges or user interaction, allowing extraction of sensitive information from the site's database. Only WordPress sites running The Events Calendar version 6.6.4 or earlier where the site owner has manually added calls to tribe_has_next_event() (for example in custom templates) are vulnerable. There are no known public proof-of-concept exploits, it is not yet in CISA's KEV catalog, and no confirmed in-the-wild exploitation is known, but EPSS assigns a high ~49.9% probability of exploitation within 30 days.

What to do: Update The Events Calendar to a version later than 6.6.4 (the first release after 6.6.4). Site owners should search their themes, custom templates, and snippet plugins for calls to tribe_has_next_event(); if the function is not used, the site is not exploitable. As an interim mitigation, apply a WAF rule blocking SQL injection patterns in the 'order' parameter.