S4E just found a high top 10 tcp port service scan
high·Product Based Web Vulnerabilities·Updated Jan 7, 2024

CVE-2015-2196 Scanner

SQL injection in Spider Calendar 1.4.9 via cat_id parameter in spiderbigcalendar_month action to wp-admin/admin-ajax.php allows remote attackers to execute arbitrary SQL commands.

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsdomain, ipv4, subdomain
CostFree
2.5k
Times Used
continuous scan runs
3.4k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2015-2196
7.5
CVSS

SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php.

Attack Vector
-
Privileges Req.
-
User Interaction
-
Affected
n/aby n/a
n/a
Updated Aug 22, 2026View on NVD →
Detail

Spider Event Calendar is a WordPress plugin designed to help website owners manage and display events seamlessly. It allows users to create, categorize, and schedule events, integrating them via shortcodes and widgets. Commonly used by event organizers, bloggers, and businesses, it simplifies event management on WordPress sites. However, its popularity also makes it a target for attackers seeking to exploit vulnerabilities.

CVE-2015-2196 is a critical SQL injection vulnerability found in Spider Event Calendar version 1.4.9. This flaw arises due to insufficient sanitization of user-supplied input passed to the cat_id parameter. Attackers can inject malicious SQL queries by manipulating this parameter, bypassing authentication and gaining unauthorized access to the database.

The vulnerability is triggered through the spiderbigcalendar_month action in the wp-admin/admin-ajax.php endpoint. Specifically, the cat_id parameter is directly concatenated into SQL queries without proper validation or escaping. This allows an attacker to craft a request with malicious SQL code, such as UNION-based injections, to extract sensitive data from the database.

If exploited, this vulnerability can lead to severe consequences, including unauthorized access to user credentials, personal data, and even full database compromise. Attackers can steal sensitive information like usernames, passwords, and payment details, install backdoors, or launch further attacks. The CVSS score of 7.5 highlights its high severity, making immediate remediation critical.

Solution Advice
  • Update the Spider Event Calendar plugin to the latest patched version immediately.
  • If an update is unavailable, disable the plugin until a fix is released.
  • Implement input validation and parameterized queries for all user-supplied data, especially the cat_id parameter.
  • Use a web application firewall (WAF) to detect and block SQL injection attempts.
  • Restrict access to the wp-admin directory using IP whitelisting or .htaccess rules.
  • Regularly audit and monitor database logs for suspicious queries or unauthorized access.
  • Apply the principle of least privilege to database accounts used by the plugin.
  • Conduct periodic security scans with tools like S4E to identify and remediate vulnerabilities.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Spider Calendar SQLi Scanner | S4E Free Check S4E