An unauthenticated SQL injection flaw exists in older releases of Webnus Inc.’s Modern Events Calendar WordPress plugin. The flaw allows an attacker to inject arbitrary SQL through unsanitized input parameters, enabling the reading, modification, or deletion of database records. This can lead to confidential data exposure or integrity compromise and, depending on database privileges, may provide a pathway to execute arbitrary code on the web server.

All versions of the Modern Events Calendar plugin published by Webnus Inc. prior to 7.35.0, affecting any WordPress site that has the plugin installed. No specific build numbers are listed, so all pre‑7.35.0 installations are considered vulnerable.

The CVSS score of 9.3 classifies the issue as critical. While the EPSS score is unavailable, the lack of an entry in the CISA KEV list does not diminish its high severity. The flaw is exploitable remotely, without authentication, by sending crafted HTTP requests that target the plugin’s insecure database query. Attackers can therefore access or alter protected data from any internet‑accessible WordPress installation running the affected plugin.