datxzzz/cve-2026-93300Python proof-of-concept for CVE-2026-93300, an unauthenticated SQL injection in the EventON Subscriber WordPress plugin; fingerprints the AJAX handler and extracts database data via time-based oracles.
Python proof-of-concept for CVE-2026-93300: unauthenticated SQL injection via the email parameter in the EventON - Subscriber WordPress plugin (Wordfence, CVSS 7.5 High).
| CVE | CVE-2026-93300 |
| Plugin | EventON - Subscriber (eventon-subscriber) |
| Affected | all versions ≤ 1.4.5 |
| Fixed version | none published (as of 2026-10) |
| Vector | POST /wp-admin/admin-ajax.php, action=evosub_new_subscriber, param email |
| Auth | none (unauthenticated) |
| CWE | CWE-89 SQL Injection |
The subscription-form AJAX handler (evosub_new_subscriber, registered with wp_ajax_nopriv_, reachable from the public front-end form in assets/evosub_script.js) builds an existing SQL query using the user-supplied email value without $wpdb->prepare() / proper escaping. The value reaches the query unescaped, so an attacker can break out of the string literal and append/modify the query to read arbitrary data from the database.
The client-side email regex in evosub_script.js is the only format check in the browser; it provides no server-side protection.
# 1. Detect only (fingerprint handler, find working injection oracle)
python3 cve_2026_93300.py --url https://target.example --mode check
# 2. Dump wp_users (login / email / password hash)
python3 cve_2026_93300.py --url https://target.example --mode users --prefix wp_
# 3. Extract any scalar query result
python3 cve_2026_93300.py --url https://target.example --mode sql \
--sql "SELECT option_value FROM wp_options WHERE option_name='admin_email'"
| Option | Default | Description |
|---|---|---|
--mode | check | check / users / sql |
--action | evosub_new_subscriber | AJAX action to test |
--param | email | injected parameter |
--prefix | wp_ | WordPress table prefix |
--sql | — | scalar SELECT for --mode sql |
--delay | 2.0 | SLEEP() seconds for time-based oracle |
--timeout | 25 | HTTP timeout |
--max-id | 15 | highest user ID to scan |
--proxy / --insecure / --ua | — | HTTP proxy / skip TLS verify / custom UA |
action=evosub_new_subscriber against an unregistered action (0 / HTTP 400) to confirm the handler is present and alive.', ", \) → if SQL errors are reflected (WP_DEBUG), an error-based oracle is used (fastest, single request per bit);SLEEP() → union-time oracle (one evaluation per probe, no per-row slowdown);;SELECT SLEEP(...)) → stacked-time oracle if the driver allows multi-statements;OR/AND/paren/concat SLEEP) → template-time oracle fallback.1=1 → true and 1=0 → false (repeated) before extraction begins, which filters out false positives from slow/unstable targets.LENGTH() and ASCII(SUBSTRING(...)) (7 requests per character).--mode check finishes with a sanity extraction of user_login@USER() to prove data access.
poc*@example.invalid entries in the evo-subscriber post type; they are visible under Events → All Subscribers and can be trashed.email server-side with a strict filter, all probes behave identically and the tool reports not vulnerable / input validated.admin-ajax.php (fatal on baseline) are reported as unhealthy and aborted.SELECT query shapes (INSERT/UPDATE context) are detected but may have no working time oracle.--delay ≥ 1.0 on real targets; very small delays produce false negatives on high-latency links.email (and all request input) with $wpdb->prepare() / esc_sql(); validate with is_email() server-side.admin-ajax.php requests whose email value contains SQL metacharacters (', ", \, --, ;, UNION).For authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. You are responsible for complying with all applicable laws.