The vulnerability is an improper neutralization of special elements in an SQL command, allowing blind SQL injection by an attacker. A successful exploit could give an attacker read or write access to the underlying WordPress database, enabling data exfiltration, defacement, or further compromise.

Webnus Modern Events Calendar Lite plugin for WordPress is affected when running any version prior to 7.37.0. Users who have not updated this plugin are vulnerable.

The CVSS score of 8.5 indicates a high severity level. The EPSS score of < 1% indicates a very low probability of exploitation, but it does not eliminate the risk. The lack of inclusion in the CISA KEV catalogue does not remove the risk. The likely attack vector is via a request processed by the plugin’s API or frontend forms, and it is inferred that the exploit can be performed without authentication or with minimal privilege, making it potentially easier for an attacker to target the site.