EUVD-2026-45879
GHSA-cqmp-4w3x-r378
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated remote SQLi via public AJAX (AV:N/AC:L/PR:N/UI:N); scope changed as it exposes the whole WP database (S:C/C:H); no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
Articles & Coverage 1
AnalysisAI
Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all versions before 7.34.0) lets remote attackers extract sensitive database contents by injecting into an unsanitized request parameter used within a SQL statement, reachable through an AJAX action open to unauthenticated users. Publicly available exploit code exists (reported by WPScan), and a vendor patch is available; the CVSS 8.6 rating reflects a scope-changed, high-confidentiality impact with no authentication or user interaction required. No EPSS score or CISA KEV listing was provided, so there is no public exploit identified as being actively exploited at time of analysis.
Technical ContextAI
The vulnerability is a classic CWE-89 SQL Injection: user-controlled input from a request parameter is concatenated into a database query without sanitization or escaping. The affected components are two WordPress plugins from the same product family - Modern Events Calendar Lite (the free version) and Modern Event Calendar Pro (the paid version), identified by CPE strings cpe:2.3:a:unknown:modern_event_calendar_pro and cpe:2.3:a:unknown:modern_events_calendar_lite. The injection point is exposed via a WordPress AJAX handler (typically an admin-ajax.php action with a nopriv hook) that is intentionally reachable by unauthenticated visitors, meaning the vulnerable code path is exposed to the public internet on any site running the plugin. Because these plugins share a common code base, the same flawed query-building logic affects both editions up to and including 7.33.x.
RemediationAI
Vendor-released patch: upgrade both Modern Events Calendar Lite and Modern Event Calendar Pro to version 7.34.0 or later, which is available from the vendor and remediates the SQL injection; this is the primary and recommended fix. Consult the WPScan advisory at https://wpscan.com/vulnerability/572229cb-8a09-406d-8623-7d6b553bfdde/ for specifics before updating. If immediate patching is not possible, apply compensating controls: deploy a Web Application Firewall (WAF) rule to block SQL-injection patterns and requests to the vulnerable admin-ajax.php action for the plugin (side effect: overly broad rules may block legitimate calendar AJAX calls and break event browsing), restrict access to /wp-admin/admin-ajax.php by IP where feasible (side effect: breaks front-end AJAX features for real users if the endpoint is needed publicly), or temporarily deactivate the Modern Events Calendar plugin until it can be updated (side effect: removes all calendar/event functionality from the site). After patching, rotate WordPress secret keys/salts and any credentials that may have been exposed, since exploit code is public.
More in Modern Events Calendar Lite
View allArbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly chec
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before usi
Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[
The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validat
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not proper
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider par
The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and
The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule p
The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.
The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which c
Same weakness CWE-89 – SQL Injection
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today