EUVD-2026-45879
GHSA-cqmp-4w3x-r378
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated remote SQLi via public AJAX (AV:N/AC:L/PR:N/UI:N); scope changed as it exposes the whole WP database (S:C/C:H); no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
Articles & Coverage 1
AnalysisAI
Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all versions before 7.34.0) lets remote attackers extract sensitive database contents by injecting into an unsanitized request parameter used within a SQL statement, reachable through an AJAX action open to unauthenticated users. Publicly available exploit code exists (reported by WPScan), and a vendor patch is available; the CVSS 8.6 rating reflects a scope-changed, high-confidentiality impact with no authentication or user interaction required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target site must run Modern Events Calendar Lite or Modern Event Calendar Pro at a version before 7.34.0 with the plugin active, exposing the vulnerable unauthenticated AJAX action (a nopriv admin-ajax.php handler) that reaches the injectable request parameter. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority rather than an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP request to the plugin's public AJAX action, injecting SQL syntax into the vulnerable parameter to make the database return arbitrary rows. Using a publicly available POC, they run a UNION-based or blind extraction to dump the wp_users table, harvesting administrator password hashes and secret keys, which can then be cracked or replayed to take over the site. … |
| Remediation | Vendor-released patch: upgrade both Modern Events Calendar Lite and Modern Event Calendar Pro to version 7.34.0 or later, which is available from the vendor and remediates the SQL injection; this is the primary and recommended fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances using Modern Event Calendar Pro or Modern Events Calendar Lite plugins and determine their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today