Is CVE-2021-24943 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Registrations For The Events Calendar – Event Registration Plugin

CVE-2021-24943

The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a…

Vulnerability class: SQL Injection

EPSS: 0.555 (98.1th percentile) — read the EPSS interpretation.

Affected products

Unknown Registrations For The Events Calendar – Event Registration Plugin — versions 2.7.6

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

20142995/nuclei-templates

References

wpscan.com/vulnerability/ba50c590-42ee-4523-8aa0-87ac644b77ed (x_refsource_MISC)

Frequently asked questions

What is CVE-2021-24943?: CVE-2021-24943 is a vulnerability in Registrations For The Events Calendar – Event Registration Plugin, classified under SQL Injection. Published 2021-12-06.
Is CVE-2021-24943 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.