Simple Events Calendar <= 1.3.5 - Authenticated SQL Injection

Description

Type user access: administrator user.
$_POST[‘event_id’] is not escaped.

File / Code:

Path Request: /wp-content/plugins/simple-events-calendar/simple-events-calendar.php

Line : 467

$edit_event = $_POST['event_id'];
$update = $wpdb->get_results( " SELECT * FROM $table_name WHERE id = $edit_event ", "ARRAY_A" );