PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-97287 Liquid Web / StellarWP CVE debrief

The WordPress Event Tickets plugin has a SQL Injection vulnerability, allowing for Blind SQL Injection attacks. This issue affects Event Tickets versions up to 5.29.5. The vulnerability has a CVSS score of 8.5 and is considered HIGH severity. Limited details are available on exploitation or impact, so verification and inventory checks are necessary. Affected WordPress administrators and security teams should assess exposure and prioritize patching or mitigation. The CVE Program and NVD records confirm the SQL Injection vulnerability in Event Tickets versions up to 5.29.5.

Vendor
Liquid Web / StellarWP
Product
Event Tickets
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-30
Original CVE updated
2026-10-14
Advisory published
2026-09-30
Advisory updated
2026-10-14

Who should care

WordPress administrators, security teams, and developers using the Event Tickets plugin should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-97287 is a SQL Injection vulnerability in the WordPress Event Tickets plugin, allowing for Blind SQL Injection attacks. Defenders should prioritize patching or mitigating this vulnerability, especially for WordPress installations using the Event Tickets plugin. The vulnerability has a CVSS score of 8.5 and is considered HIGH severity. Limited details are available on exploitation or impact, so verification and inventory checks are necessary.

  • Potential for unauthorized database access
  • Risk of data tampering or exposure
  • Need for patching or mitigation to prevent exploitation
  • Importance of monitoring for suspicious database activity

Technical summary

The WordPress Event Tickets plugin has a SQL Injection vulnerability, allowing for Blind SQL Injection attacks. This issue affects Event Tickets versions up to 5.29.5. The vulnerability has a CVSS score of 8.5 and is considered HIGH severity. Defenders should prioritize patching or mitigating this vulnerability, especially for WordPress installations using the Event Tickets plugin. The vulnerability allows for potential unauthorized database access and risk of data tampering or exposure.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for WordPress installations using the Event Tickets plugin.

Recommended defensive actions

  • Patch or upgrade Event Tickets to a version beyond 5.29.5
  • Implement Web Application Firewall (WAF) rules to detect and prevent SQL Injection attacks
  • Monitor for suspicious database activity
  • Perform regular vulnerability scans and inventory checks

Evidence notes

The CVE Program and NVD records confirm the SQL Injection vulnerability in Event Tickets versions up to 5.29.5. Limited details are available on exploitation or impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-97287 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-97287

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-97287 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-97287

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.