CVE-2025-39481: Critical Blind SQL Injection in Eventer Plugin

CVE-2025-39481 is a critical blind SQL injection flaw (CVSS 9.3) in the imithemes Eventer plugin for WordPress, in versions before 3.11.4. It needs no login. The fix is to update to 3.11.4 or later on every site that runs the plugin, then review your logs and user accounts.

What's affected

The record names the imithemes Eventer plugin, from n/a through versions before 3.11.4, and describes a blind SQL injection.

Patchstack's page for this entry lists versions below 3.11.4 as vulnerable and 3.11.4 as the patched version. It also lists the required privilege as unauthenticated, which matches the vector in the record. Patchstack rates its own priority for the issue as low, while the CVSS score is 9.3, so use your own judgment about how exposed the plugin is on your sites.

The record lists the weakness as CWE-89 (SQL injection). The CVSS 3.1 score is 9.3 (critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. The vector shows the flaw can be reached over the network, and no login is needed. Confidentiality impact is rated high, integrity no and availability low.

The record does not say this flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false.

How to check if you're exposed

Check each WordPress install for the plugin and its version.

1. With WP-CLI, list the plugin and its version on each site:

wp plugin list --fields=name,status,version | grep -i eventer

2. Without WP-CLI, open the Plugins page in the dashboard and read the version under Eventer Event Booking Manager. Compare it with 3.11.4.
3. Look for version 3.11.4 or later, the patched version listed by Patchstack.
4. Remember that an inactive theme or plugin can still be reachable on disk. Check the folder under wp-content as well, and delete anything you do not use.

If you manage many sites, the free in-browser dependency scan covers application dependencies, and the Gold directory lets you look up other CVEs by product. Themes and plugins still need to be checked on each site.

What to do now

1. Update Eventer to 3.11.4 or later on every site, then clear caches.
2. If you cannot update today, deactivate the plugin or restrict public access to its pages until you can.
3. Review the database for new administrator accounts or changed options, and review booking and customer records for odd entries.
4. Look in web server logs for slow or repeated requests to event pages, which is a common pattern for blind injection probes.
5. Use a database account for WordPress with only the permissions it needs.
6. Keep automatic updates on for plugins that have had security fixes.

Why it matters

Blind SQL injection is the variant where the page does not print database errors or results back. An attacker learns about the data by watching how the application behaves, such as whether a page loads or how long it takes. That is slower than other forms, but it can still reach everything the database account can read.

The record lists CWE-89. Event and booking plugins hold names, email addresses and sometimes payment related details, so a database flaw in one is more than a technical problem. The fix is already published, which makes this a patching task, and the main risk is the sites that nobody remembers to update.

Quick check

Sources

• Gold entry for CVE-2025-39481
• NVD record for CVE-2025-39481, published 2025-05-16, as summarized above
• Patchstack entry for Eventer

Last reviewed: 18 October 2026.