Modern Events Calendar CVE-2026-11349

The target site must run Modern Events Calendar Lite or Modern Event Calendar Pro at a version before 7.34.0 with the plugin active, exposing the vulnerable unauthenticated AJAX action (a nopriv admin-ajax.php handler) that reaches the injectable request parameter. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special authentication, user-interaction, or non-default configuration requirements beyond having the plugin installed and enabled - exploitation works remotely against default configurations. The main limiting factor is deployment: only sites with these specific plugins active are affected, and impact is confined to confidentiality (data extraction), not modification or denial of service. The exact vulnerable AJAX action name and parameter were not disclosed in the provided data.

This is a genuine priority rather than an inflated high-CVSS score. Every CVSS signal points to easy, remote exploitation: AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), with a changed scope (S:C) and high confidentiality impact (C:H), yielding 8.6. The scope change reflects that a SQL injection into the WordPress database can expose data belonging to WordPress core and other plugins - not just the calendar plugin's own tables - including password hashes, session/auth tokens, and secret keys. POC/exploit code is publicly available per WPScan, which materially raises real-world risk and lowers the barrier for opportunistic mass scanning of WordPress sites. No EPSS probability was supplied in the input, so the statistical exploitation likelihood cannot be quantified here, and there is no CISA KEV entry indicating confirmed active exploitation - so exploitation should be treated as feasible and likely-to-be-attempted, but not independently confirmed as ongoing. Integrity and availability are rated N, so the primary threat is data theft (information disclosure) rather than data destruction, though extracted admin credentials could enable follow-on full site compromise.

An unauthenticated attacker sends a crafted HTTP request to the plugin's public AJAX action, injecting SQL syntax into the vulnerable parameter to make the database return arbitrary rows. Using a publicly available POC, they run a UNION-based or blind extraction to dump the wp_users table, harvesting administrator password hashes and secret keys, which can then be cracked or replayed to take over the site. Because the attack requires no authentication and low complexity, it is well-suited to automated mass exploitation across many WordPress installations.