Plugin inspection:

The Events Calendar

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Warnings

The version of this plugin that this recommendation was based on is known to be vulnerable to attack:

This recommendation applies to version 3.0 of this plugin, but the most recent version is 5.2.1.1. These findings may no longer be correct.

Findings

This plugin is an odd beast: parts of it are very well architected, others not.  It contains numerous issues of concern.

Contains numerous unescaped outputs and unfiltered inputs:

  • ./lib/the-events-calendar.class.php lines 3219 onwards
  • ajax_handler_ticket_add in ./lib/tickets/tribe-tickets.php

This plugin also passes unsanitised input into hook arguments and abstract functions, making it very hard to trace how those inputs are used.

Although many SQL statements are prepared, a large one is not in lib/tribe-admin-events-list.class.php at line 3617.

The plugin also uses call_user_func with unvalidated inputs. These are not trivially exploitable (as far as we are aware) because the callable is split into a class name and method:

// Note: $vars is derived from $_GET['attendee'] without whitelisting
$obj = call_user_func( array( $vars[1], 'get_instance' ) );

However, this is definitely an idiom which needs to be employed with greater care.

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

Numerous examples of poor security practice, probably contains XSS, indications of SQLi and arbitrary code vulnerabilities as well (not investigated).

Failure criteria

  • Lack of input sanitisation
  • Execution of unprepared SQL statements
  • Unsafe generation of PHP code
  • Lack of proper output escaping
  • Very large codebase

Read more about our failure criteria.