A critical SQL injection flaw in the WordPress plugin The Events Calendar, published by Liquid Web, could let unauthenticated attackers extract sensitive information from a site’s database.
Affected are versions 6.15.12 (November 2025) through 6.16.2 (May 2026). Users are urged to update to version 6.16.3 or later. The Events Calendar is a WordPress events plugin from StellarWP, part of the Liquid Web family of brands.
Tracked as CVE-2026-49772 and rated 9.3 on CVSS by Patchstack, the flaw is exploitable over the network with no credentials or user interaction. A successful attack allows an adversary to access user records, password hashes and other database content.
Easy to exploit
The score breaks down to low attack complexity and high confidentiality impact — easy to run, and able to expose protected data. Patchstack assigned that rating; NIST has not yet scored the flaw independently.
There are no reports of the bug being exploited in the wild.
WordPress.org lists the plugin at more than 700,000 active installations while the plugin publisher Liquid Web’s marketing puts the install base at 800,000. The Events Calendar is used by small and midsize WordPress sites, with a footprint extending to larger event-driven organizations, venues, agencies, universities, businesses and community organizations, according to the publisher.
WordPress security company Patchstack describes the bug as “highly dangerous and expected to become exploited.”
“Vulnerabilities like this one are used in mass-exploit campaigns. Attackers use these to attack thousands of websites at a time, regardless of traffic size or popularity,” Patchstack wrote.
Breaking down the bug
SQL injection ranks among the oldest attacks on the web. Applications build database queries from user input: search terms, URL parameters, form fields. When code fails to properly separate that input from the query’s instructions, an attacker can insert their own SQL, short for Structured Query Language. The database runs it because it cannot reliably separate instruction from data.
The SQL flaw impacting The Events Calendar is the blind variant. A standard injection returns the database’s answer to the attacker directly. A blind injection returns nothing — no error, no data on screen.
The attacker instead asks the database yes-or-no questions and reads the answer in how the application responds: a page that loads or fails, a reply that arrives fast or slow. Run across enough automated requests, the technique can reconstruct sensitive values one piece at a time.
Because The Events Calendar shares the site’s main WordPress database, a successful blind injection could reach past event listings into any table the database user can read — on a standard install, that means the table holding user accounts and their stored passwords.
Reporting timeline
Patchstack says the vulnerability was reported May 24 by researcher vtim and published June 8. The vendor’s public changelog for The Events Calendar 6.16.3, dated May 28, lists two functional fixes and language updates, but does not explicitly flag the release as a security update. Patchstack and Wordfence both identify 6.16.3 as the patched version.
Security teams are advised to review web server logs, WAF alerts and WordPress security telemetry for suspicious traffic targeting calendar, event search or event listing functionality. Look for repeated probing, encoded payloads, SQL keywords, timing functions and unusual query strings.
If suspicious activity appears, treat this as a possible database exposure investigation, not just a routine plugin update. Preserve logs, review administrator accounts, check for unexpected WordPress users or option changes, and rotate secrets or API tokens stored in the WordPress database.
