Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

Description

The plugin does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.
The permitted character set prevents the injection from reading data back, so the impact is limited to integrity of the plugin's own booking records.