Modern Events Calendar CVE-2026-96534

Requires an authenticated WordPress account with Subscriber role or above on a site running Modern Events Calendar Lite or Modern Event Calendar Pro prior to version 7.37.0 - this is the explicit prerequisite from the description (PR:L). The practical limiting factor is this authentication requirement: sites that disable public user registration dramatically reduce exposure, since an attacker must first obtain a valid low-privilege account. No special non-default plugin configuration is named in the description; the vulnerable parameter is reachable by any authenticated user at or above Subscriber level. No user interaction by a victim is needed (UI:N).

This is a credible mid-tier priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection, but the description and PR:L confirm it requires an authenticated account at Subscriber level or above - not fully anonymous access. Signals are largely consistent: a public exploit exists (WPScan), reinforcing feasibility, but KEV status is NO (not CISA-listed) and the SSVC decision is Exploitation=none / Automatable=no / Technical Impact=partial, indicating no observed active exploitation and limited mass-exploitation potential. EPSS is NOT provided in the input, so probabilistic exploitation likelihood cannot be quoted. One notable tension: the vendor scored this S:C (scope changed) and C:H/I:N/A:N, yielding 7.7, but a Subscriber-level account requirement on sites that allow open registration is the key risk multiplier - on sites where registration is disabled, the realistic attack surface is much smaller. Bottom line: a confirmed, publicly-exploitable authenticated SQLi in a widely-used plugin, worth prompt patching, but not a drop-everything zero-day given the authentication requirement and absence of KEV/active-exploitation signals.

An attacker registers (or abuses an existing) low-privilege Subscriber account on a WordPress site running Modern Events Calendar Lite or Pro below 7.37.0, then sends a crafted request injecting SQL through the unsanitised parameter. Because a public exploit is available via WPScan, weaponisation is low-effort, allowing extraction of sensitive database contents such as password hashes, user data, and secret keys. Exploitation is remote (AV:N) and low-complexity (AC:L) but gated behind authentication (PR:L), so sites permitting open user registration are most exposed.