Introduction
Many WordPress sites depend on event management features, and The Events Calendar plugin is the go-to choice for over 700,000 active installations. A newly disclosed vulnerability, CVE-2025-9807, exposes these sites to time-based SQL injection that an attacker can trigger without authentication. A successful attack can potentially compromise the database and leak its data.
The Events Calendar is developed by theeventscalendar.com. It is one of the most widely used plugins in the WordPress ecosystem, so a security issue here affects organizations of all sizes.
Technical information
CVE-2025-9807 is a time-based SQL injection vulnerability in The Events Calendar plugin for WordPress, present in all versions up to and including 6.15.1. The root cause is how the plugin handles the 's' parameter, which it typically uses for search. The plugin does not escape that input sufficiently and does not use prepared statements for it.
The vulnerable code is in src/Events/Custom_Tables/V1/WP_Query/Custom_Tables_Query.php (reference).
An attacker can send specially crafted input in the 's' parameter. Because the plugin does not properly sanitize or parameterize that input, the attacker can inject SQL into the queries the plugin executes. In a time-based SQL injection, the attacker calls a database timing function (such as SLEEP() in MySQL) and infers data from how long the server takes to respond to different queries. This lets the attacker exfiltrate data even when error messages are suppressed or the query output is not directly visible.
The plugin's custom query implementation bypasses some of WordPress's built-in protections, so it is more susceptible to this class of vulnerability. No public patch or detection method is currently available.
Affected systems and versions
- Product: The Events Calendar WordPress plugin
- Affected versions: All versions up to and including 6.15.1
- Vulnerable configuration: Any WordPress site with the plugin enabled and reachable by unauthenticated users
Vendor security history
The Events Calendar plugin has a history of critical security issues, including:
- CVE-2024-8275: Unauthenticated SQL injection in versions up to 6.6.4 (WordFence advisory)
- CVE-2024-6931: Stored XSS (WordFence advisory)
- CVE-2024-5333: Authorization bypass (WordFence advisory)
The recurrence of similar vulnerabilities suggests ongoing problems with the vendor's secure development and code review practices.
