An authenticated SQL injection vulnerability in the Events Manager WordPress plugin, fixed in version 7.4.1, poses a significant risk of unauthorized data modification.

This vulnerability is a SQL injection (CWE-89) flaw resulting from insufficient sanitization of user-controlled input. It requires a low level of authentication, specifically a subscriber account or higher, to execute unauthorized database queries.

The ability to perform SQL injection attacks allows authenticated attackers to manipulate booking consent records, which may lead to unauthorized data access or integrity loss. With a CVSS score of 8.1, this vulnerability is categorized as High, representing a serious threat to the confidentiality and integrity of customer-related data managed by the plugin.

Immediate Action: Update the Events Manager plugin to version 7.4.1 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review database query logs for unusual patterns or syntax errors that may indicate automated SQL injection attempts originating from subscriber accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection payloads targeting WordPress plugin parameters.

Public Exploit Available: No (There is no confirmed public availability of a weaponized exploit or Metasploit module in the provided data).

Given the High severity of this vulnerability and the existence of a proof-of-concept, administrators should prioritize applying the 7.4.1 patch across all affected WordPress installations. Organizations should also audit existing subscriber accounts to ensure no unauthorized access is being leveraged to facilitate this attack.