Modern Events Calendar EUVD-2026-100988

Exploitation requires an authenticated session on the WordPress site with the privilege level accepted by the vulnerable Modern Events Calendar Lite endpoint (CVSS PR:L confirms at least low-privilege authentication is needed - not unauthenticated), plus the plugin being installed and active at a version before 7.37.0. No special non-default configuration or user interaction (UI:N) is indicated by the data. The primary limiting factor is the authentication requirement: an attacker must first obtain or register a valid low-privileged account, so sites that restrict account registration or lack the relevant user roles present a materially higher barrier.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5 High) indicates a network-reachable, low-complexity, authenticated (PR:L) blind SQL injection with a claimed scope change and high confidentiality impact. No EPSS score, CISA KEV listing, or public POC was supplied in the intelligence, so exploitation probability cannot be quantified from the data: per the precision rules this is 'no public exploit identified at time of analysis,' NOT active exploitation. The single source is Patchstack (a credible WordPress-focused vulnerability database), which lends confidence to the vulnerability's existence and the affected-version boundary, but there is no independent NVD enrichment, no SSVC decision data, and no vendor advisory text beyond the Patchstack entry. Net assessment: this is a genuine, credible authenticated SQLi in a widely-installed WordPress plugin and warrants prompt patching, but it is not a drop-everything emergency absent evidence of exploitation - the PR:L requirement (a logged-in account) meaningfully lowers real-world risk versus an unauthenticated flaw. Note a conflict to verify: the input marks Scope:Changed (S:C), which is atypical for in-database SQL injection and inflates the score; the scope-change claim should be verified with the vendor/Patchstack before treating 8.5 as settled.

An attacker who holds any low-privileged authenticated account on the target WordPress site (e.g., a subscriber or contributor, depending on the vulnerable endpoint's capability check) sends a crafted request to a Modern Events Calendar Lite parameter that is concatenated into an SQL query. Because the injection is blind, the attacker uses boolean- or time-based inference to extract data such as user password hashes or secret keys from the WordPress database. No public exploit code was identified at the time of analysis, but the low attack complexity (AC:L) makes exploitation straightforward once a foothold account exists.