CP Multi View Event Calendar CVE-2026-109901

Exploitation requires an authenticated WordPress session with at least low-level privileges (CVSS PR:L) on a site that has the CP Multi View Event Calendar plugin installed and active at version 1.4.41 or earlier; the attacker then supplies malicious SQL through a vulnerable plugin input that is passed unsanitized into a database query. The primary limiting factors are the authentication requirement (a valid plugin-enabled account is needed, so this is not exploitable by fully anonymous visitors) and the dependency on the vulnerable plugin being installed and enabled; no non-default configuration beyond having the plugin active is indicated in the available data. The exact privileged role and injectable endpoint are not specified in the input and should be confirmed against the Patchstack advisory.

This is an authenticated SQL injection (CWE-89) in the Codepeople CP Multi View Event Calendar WordPress plugin (versions through 1.4.41), reported by Patchstack with a CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The CVSS vector signals network-reachable, low-complexity exploitation requiring only low privileges (PR:L) and no user interaction, with a changed scope and high confidentiality impact - consistent with a typical Patchstack-scored WordPress plugin SQLi reachable by a low-privileged authenticated user. However, several key real-world signals are MISSING: there is no EPSS probability, no CISA KEV listing, and no public POC referenced in the input, so exploitation likelihood cannot be quantified. The PR:L requirement is a meaningful limiter - an attacker needs at least a valid authenticated account on the target WordPress site - which lowers real-world risk relative to a fully unauthenticated flaw despite the high 8.5 score. The input also lists I:N while rating A:L, which is atypical for SQL injection (injection commonly permits at least limited data modification); treat the exact impact breakdown as vendor-assigned and verify against the Patchstack advisory. Net: a genuine high-severity issue worth prioritized patching on affected sites, but absent KEV/EPSS/POC evidence it reads as a patch-soon vulnerability rather than a confirmed mass-exploitation emergency.

An attacker holding a low-privileged authenticated account on a WordPress site running CP Multi View Event Calendar (<= 1.4.41) submits crafted input to a vulnerable plugin parameter that is concatenated into an SQL query, injecting their own SQL. This lets them read sensitive database contents such as user records and password hashes. No public exploit code is referenced in the available data, and the low attack complexity (AC:L) means a working payload would be straightforward once the injectable parameter is identified.