CVE-2022-0478: 
WordPress vulnerability analysis and mitigation

The Event Manager and Tickets Selling for WooCommerce WordPress plugin before version 3.5.8 contains a SQL injection vulnerability identified as CVE-2022-0478. The vulnerability was discovered on February 2, 2022, and publicly disclosed on February 21, 2022. This security issue affects the mage-eventpress plugin, specifically impacting users with contributor-level access or higher (WPScan Vuln).

The vulnerability stems from improper validation and escaping of the post_author_gutenberg parameter when creating or editing events. The issue has been assigned a CVSS score of 7.7 (High) and is classified as a SQL Injection vulnerability (CWE-89). The vulnerability falls under the OWASP Top 10 category A1: Injection (WPScan Vuln).

This vulnerability could allow users with contributor-level access or higher to perform SQL injection attacks against the affected WordPress installation. The successful exploitation could potentially lead to unauthorized database access and manipulation (CVE Details).

The vulnerability has been fixed in version 3.5.8 of the Event Manager for WooCommerce plugin. Users are advised to update to this version or later to mitigate the risk (WPScan Vuln).