Notifications
Clear all
Topic starter
02/08/2026 12:26 pm
TL;DR: A time-based SQL injection in the Events Calendar WordPress plugin can let attackers infer database responses through delayed queries, according to Hadrian’s vulnerability alert on CVE-2025-9807. The issue reinforces that application-layer injection flaws still create direct data and access risk when input handling and query construction are weak.
NHIMG editorial — based on content published by Hadrian: CVE-2025-9807, time-based SQL injection in the Events Calendar WordPress plugin
Questions worth separating out
Q: What breaks when unauthenticated SQL injection exists in WordPress core?
A: A single anonymous request can become a full application compromise if the vulnerable path reaches database logic and then chains into code execution.
Q: Why do time-based SQL injections remain dangerous even without visible errors?
A: Because attackers do not need a leaked error message if they can observe how long a request takes to complete.
Q: How can teams know whether their plugin and query controls are working?
A: Check whether all database access uses parameterised queries, whether plugin exposure is limited to necessary endpoints, and whether response latency is monitored for suspicious repetition.
Practitioner guidance
- Parameterise every database query path Replace string concatenation with prepared statements across all plugin and custom code paths that touch user-controlled input, especially event lookup and filtering endpoints.
- Reduce database account scope Assign separate read and write roles for internet-facing application accounts and remove privileges the Events Calendar plugin does not need, including schema modification and broad table access.
- Review third-party WordPress extensions continuously Track plugin versions, exposure paths, and change windows so security owners can identify vulnerable extensions before they are exploited in public-facing environments.
What's in the full analysis
Hadrian's full vulnerability alert covers the operational detail this post intentionally leaves for the source:
- Request-level exploit context for CVE-2025-9807 and how the vulnerable parameter behaves under timing tests
- Exposure notes on where the Events Calendar WordPress plugin sits in the request path and why that matters operationally
- Patch and remediation considerations that help teams move from analysis to implementation
- Related vulnerability references that help teams compare this issue with adjacent WordPress and PHP flaws
👉 Read Hadrian’s alert on CVE-2025-9807 in the Events Calendar WordPress plugin →
WordPress Events Calendar SQL injection: what teams need to fix?
Explore further
02/08/2026 1:25 pm
Application-layer trust is still the first control boundary most teams under-estimate. Time-based SQL injection is not a niche bug class. It is a reminder that untrusted input, when allowed to shape query logic, can bypass many higher-level security assumptions. For identity programmes, that matters because application data often feeds authentication, authorisation, and audit pipelines. The control lesson is simple: if the query layer is weak, identity and access controls built on top of it inherit that weakness.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: Who is accountable when a vulnerable plugin exposes application data?
A: Accountability usually sits with the application owner, platform owner, and security team together because plugin exposure is a shared governance failure. The organisation is responsible for patching, access scoping, and monitoring, while individual teams should be clear on who approves extensions, who reviews database permissions, and who responds when a flaw becomes public.
👉 Read our full editorial: CVE-2025-9807 exposes SQL injection risk in WordPress events
