CVE-2026-49772

The The Events Calendar WordPress plugin (versions 6.15.12 through 6.16.2 ) is vulnerable to an unauthenticated blind SQL injection . The root cause is a broken REST parameter validator where validate_callback returns a closure instead of performing validation. This allows an attacker to send uns...