Description
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
Published: 2026-07-20
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Modern Event Calendar Pro and Lite WordPress plugins before version 7.34.0 allows an attacker to supply a malicious value to the mec_list_load_more AJAX endpoint. The plugin fails to sanitise or escape the input before incorporating it into a SQL query, enabling an unauthenticated SQL injection that can read arbitrary database tables, exposing sensitive information such as user credentials, event data, or site configuration.

Affected Systems

The vulnerability affects the Modern Events Calendar Pro and Modern Events Calendar Lite WordPress plugins, any installation running a version older than 7.34.0. All WordPress sites with these plugins deployed are potentially impacted.

Risk and Exploitability

The CVSS score of 8.6 indicates a high severity, but the EPSS score of less than 1% suggests that the likelihood of exploitation at this time is currently low. The flaw is not listed in the CISA KEV catalog, meaning no confirmed public exploit is known. The attack vector is a local unauthenticated AJAX request, requiring no user interaction beyond sending a crafted request to the affected endpoint.

Generated by OpenCVE AI on July 30, 2026 at 19:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Modern Events Calendar Pro and Lite plugins to version 7.34.0 or later to remove the unsanitised input handling
  • If an upgrade is not immediately possible, restrict access to the AJAX endpoint by limiting it to administrator roles or by blocking unauthenticated requests to the endpoint via web‑application firewall rules
  • Configure database permissions so that the WordPress database user has no read privilege for sensitive tables to reduce potential data exposure if injected queries succeed

Generated by OpenCVE AI on July 30, 2026 at 19:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-89
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 07:15:00 +0000

Type Values Removed Values Added
Description The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
Title Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-07-20T13:16:15.469Z

Reserved: 2026-06-05T09:13:52.543Z

Link: CVE-2026-11349

cve-icon Vulnrichment

Updated: 2026-07-20T13:16:07.128Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T20:00:20Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')