Introduction
CVE-2025-10587 in the Community Events plugin shows how little an attacker needs when SQL injection flaws slip through plugin development. A basic Subscriber-level account is enough to exploit insufficient input validation and extract or manipulate database contents, exposing sensitive site data. The flaw affects all versions up to and including 1.5.1.
Community Events is a third-party WordPress plugin that adds event management features to WordPress sites. It is less widely adopted than flagship plugins like The Events Calendar, but a significant number of community and organizational websites have used it. The plugin also has a history of SQL injection vulnerabilities, and concerns about its security maturity and maintenance have persisted.
Technical Information
CVE-2025-10587 is a critical SQL injection vulnerability in the Community Events plugin for WordPress, affecting all versions up to and including 1.5.1. The vulnerability is in how the plugin handles the event_category parameter. The plugin concatenates user-supplied input from this parameter directly into SQL queries, without proper escaping or prepared statements. An authenticated attacker with Subscriber-level access or above can therefore inject arbitrary SQL code.
The root cause is that the plugin does not sanitize or parameterize the event_category input before including it in SQL statements. The same pattern recurs across the plugin: earlier vulnerabilities in the eventyear and id parameters had this cause too. Attackers can craft input such as 1 OR 1=1, or more complex payloads, to manipulate the query logic, extract sensitive information, or modify database contents.
Automated tools like SQLMap can exploit this vulnerability, as earlier SQL injection cases in the Community Events plugin showed. The attack surface is significant because Subscriber-level access is often easy to obtain on WordPress sites with open registration or weak credential management.
The available sources include no public code snippets of the vulnerable SQL statements, but the references confirm that the plugin's codebase lacks sufficient escaping and query preparation.
Affected Systems and Versions
- Community Events WordPress plugin, all versions up to and including 1.5.1
- Vulnerable in any configuration where authenticated users (Subscriber-level and above) can supply the
event_categoryparameter
Vendor Security History
Community Events has a documented pattern of SQL injection vulnerabilities:
- CVE-2015-3313 (version 1.3.5,
eventyearparameter) - SQL injection in
idparameter (version 1.2.2) - Multiple unauthenticated and authenticated SQL injection flaws reported by Acunetix and WPScan
The plugin has been removed from the WordPress repository, likely because of repeated unresolved security issues. Together with the history of similar vulnerabilities, the removal points to systemic weaknesses in how the vendor writes secure code and responds to security problems.
References
- NVD entry for CVE-2025-10587
- Community Events plugin source (WordPress SVN)
- Wordfence vulnerability advisory
- Acunetix vulnerability report
- Exploit-DB: Community Events 1.3.5 SQL Injection
- WPScan: Community Events < 1.2.3 SQL Injection
- WordPress.org plugin removal discussion
- WordPress.org plugin removal notice
