Modern Events Calendar CVE-2026-102499

Exploitation requires an authenticated account with Subscriber-level privileges or higher on a WordPress site running Modern Events Calendar Lite or Modern Event Calendar Pro before version 7.37.0 (CVSS PR:L). The primary limiting factor is this authentication requirement: the attack is only trivially scalable on sites that allow open/self-service user registration (common for event, membership, and community sites) - on sites with closed registration the attacker must first obtain valid low-privilege credentials. No user interaction is required (UI:N) and no special non-default plugin configuration is named in the description; the vulnerable code path is the unsanitised parameter used directly in a SQL statement. Impact is limited to confidentiality (reading database data); the description claims no data modification or availability impact.

This is a genuine, actionable priority for sites running the affected plugins, though not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection (CWE-89) requiring only Subscriber-level authentication - a very low bar on WordPress sites that permit open user registration, which is common for membership, event, and community sites. Publicly available exploit code (WPScan) meaningfully raises the practical exploitation likelihood, but this is NOT confirmed active exploitation: the CVE is not listed in CISA KEV, so per precision rules the status is 'publicly available exploit code exists,' which is distinct from in-the-wild use. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The S:C (scope changed) and C:H/I:N/A:N impact reflect read-only data exfiltration from the backend database (credentials, hashes, PII, secret keys) with no claimed integrity or availability impact. Net: patch promptly, especially where public registration is enabled, but this is a credentialed data-disclosure flaw rather than an unauthenticated RCE. One signal to verify: the vendor rated scope as changed (S:C), which is atypical for a data-read-only SQLi and inflates the score - see assessed vector below.

An attacker registers a free Subscriber account on a WordPress site running Modern Events Calendar Lite or Pro below 7.37.0 (or uses any existing low-privilege account). They send a request to the vulnerable plugin endpoint with a crafted value in the unsanitised parameter, appending a UNION-based or stacked SQL query to the plugin's existing statement to read arbitrary database contents such as user password hashes and secret keys. A public exploit/proof-of-concept is already available from WPScan, lowering the skill required to carry this out.