CVE-2024-7717

The WP Events Manager plugin for WordPress contains a security flaw in versions up to 2.1.11 that allows malicious users with at least subscriber privileges to inject custom SQL code by manipulating the 'order' parameter, potentially leading to unauthorized data extraction from the database. This vulnerability arises from inadequate protection against user-supplied input and insufficient modification of existing SQL queries. As a result, authenticated attackers can exploit this weakness to access sensitive information.

Based on public CVE data (MITRE/NVD).