The Modern Events Calendar Lite and Pro WordPress plugins before 7.37.0 fail to sanitize a parameter used in an SQL statement. This omission allows an authenticated user with Subscriber level or higher to inject additional SQL clauses into existing queries. An attacker can then read sensitive data from the database, including confidential user information and event details. This flaw constitutes a classic SQL injection vulnerability using unescaped input.

The vulnerability affects the Modern Events Calendar Lite and Modern Event Calendar Pro plugins provided by Unknown. All installations running a version earlier than 7.37.0 are exposed. No specific sub‑versions are listed; any version below the stated threshold is considered vulnerable.

The CVSS score of 7.7 indicates high severity. The flaw permits data exfiltration by any Subscriber‑level user, a role that can be widely granted in WordPress sites. The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the flaw is not listed in the CISA KEV catalog, but the high potential impact combined with simple authentication requirements suggests a significant risk. An attacker would only need to send a crafted AJAX request to the mec_attendees action after authenticating as a Subscriber, making exploitation straightforward for an experienced user.