# CVE-2026-49772: The Events Calendar - SQLi

> Live exploitation tracking for CVE-2026-49772 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-49772

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** Liquid Web / StellarWP The Events Calendar
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection.

This issue affects The Events Calendar: from 6.15.12 through 6.16.2.

## CrowdSec analysis

[CVE-2026-49772](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-49772) is a critical blind SQL injection vulnerability in Liquid Web / StellarWP The Events Calendar versions 6.15.12 through 6.16.2. Remote unauthenticated attackers may exploit the flaw to query sensitive database information and potentially disrupt service.

CrowdSec has been tracking this vulnerability and its exploits since 21st of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-49772 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target `/wp-json/tec/v1/events` and inject time-based SQL payloads into the `order` parameter to exploit blind SQL injection.

## Timeline

- 2026-06-16: CVE Published. CVE-2026-49772 is published to NVD.
- 2026-10-21: Rule Released. CrowdSec releases a rule to detect CVE-2026-49772 exploitation attempts against the CrowdSec Network.

## References

- https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-15-12-6-16-2-sql-injection-vulnerability?_s_id=cve
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49772.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-49772) follows observed exploitation activity for CVE-2026-49772. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.