Modern Events Calendar CVE-2026-73339

The affected system must be running WordPress with the Modern Events Calendar plugin (Webnus) at a version below 7.35.0, with the vulnerable plugin endpoint reachable over the network. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no elevated privileges, and no user interaction are required - exploitation works against a default installation of the vulnerable plugin. The primary limiting factor is simply having the plugin installed and internet-reachable and being on a pre-7.35.0 version; sites already on 7.35.0+ or without the plugin are not exploitable.

This is a genuine priority rather than an inflated high-CVSS finding. The CVSS 3.1 base score is 9.3 with a vector indicating network attack vector, low complexity, no privileges, and no user interaction - the easiest possible exploitation profile - combined with a scope change (S:C) and high confidentiality impact. Signals are partly incomplete: no EPSS score was provided, there is no KEV listing, and no POC was referenced, so real-world exploitation is currently unproven despite the trivial exploitability. The vendor-attributed impact vector lists I:N (no integrity impact) and only A:L, so the practical threat is primarily mass data disclosure, not tampering or destruction. Given the trivial exploit conditions and the plugin's popularity, opportunistic scanning and exploitation are plausible once details or a POC circulate, so it should be treated as urgent even absent confirmed active exploitation.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable Modern Events Calendar endpoint with malicious SQL embedded in a parameter, causing the plugin to execute attacker-controlled queries against the WordPress database. Because no authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), the attacker can dump user records and password hashes at scale using automated tooling. No public POC was referenced at time of analysis, but the low complexity makes weaponization straightforward once the vulnerable parameter is known.