Platform
wordpress
Component
community-events
Fixed in
1.5.2
CVE-2025-10587 describes a critical SQL Injection vulnerability discovered in the Community Events plugin for WordPress. This flaw allows authenticated attackers, even those with Subscriber-level access, to inject malicious SQL queries and potentially extract sensitive information from the database. The vulnerability affects versions 1.0.0 through 1.5.1, and a patch is expected to be released shortly.
The SQL Injection vulnerability in Community Events allows an attacker to manipulate database queries. By injecting malicious SQL code through the event_category parameter, an attacker can bypass intended query logic and execute arbitrary SQL commands. This could lead to the extraction of sensitive data such as user credentials, plugin configuration details, or other stored information. Successful exploitation could also allow for modification or deletion of database records, leading to data corruption or denial of service. While requiring authentication (Subscriber level or higher), the relatively low privilege requirement expands the potential attack surface.
CVE-2025-10587 was publicly disclosed on 2025-10-08. The vulnerability's critical severity and ease of exploitation (requiring only authenticated Subscriber access) suggest a potential for rapid exploitation. No public proof-of-concept (POC) code has been released at the time of writing, but the SQL Injection nature of the vulnerability makes it likely that POCs will emerge shortly. The vulnerability is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.05% (14% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-10587 is to upgrade the Community Events plugin to a patched version as soon as it becomes available. Until a patch is released, consider temporarily disabling the plugin to prevent potential exploitation. As a temporary workaround, implement strict input validation and sanitization on the event_category parameter within the plugin's code, although this is not a substitute for a proper patch. Monitor WordPress access logs for unusual SQL query patterns that might indicate an attempted exploit. Web Application Firewalls (WAFs) configured to detect and block SQL injection attempts can also provide a layer of protection.
Actualice el plugin Community Events a una versión corregida (superior a 1.5.1) para mitigar la vulnerabilidad de inyección SQL. Asegúrese de realizar una copia de seguridad completa del sitio web antes de actualizar. Verifique que todas las consultas a la base de datos estén correctamente escapadas y preparadas para prevenir futuras inyecciones SQL.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-10587 is a critical SQL Injection vulnerability affecting the Community Events WordPress plugin, allowing attackers to extract sensitive data through the event_category parameter.
You are affected if your WordPress site uses the Community Events plugin in versions 1.0.0 through 1.5.1.
Upgrade the Community Events plugin to a patched version as soon as it is available. Temporarily disable the plugin until a patch is released.
While no public exploits are currently known, the vulnerability's critical severity suggests a high likelihood of exploitation.
Check the Community Events plugin's official website or WordPress plugin repository for updates and security advisories.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.