The vulnerability exists in the Modern Events Calendar Lite and Pro WordPress plugins before version 7.37.0. A parameter passed to the mec_fes_csv_export function is used directly in a SQL query without proper sanitization or escaping, enabling an authenticated user with Subscriber or higher privileges to inject arbitrary SQL statements. This can lead to unauthorized read or manipulation of the database, potentially exposing sensitive data or altering event information.

Both the Lite and Pro editions of the Modern Events Calendar WordPress plugin are affected. Any installation using a version older than 7.37.0 is vulnerable regardless of the hosting environment or server configuration.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the impact is significant due to the SQL injection flaw and the relatively low privilege barrier for exploitation. Attackers who can log in as any user role above Subscriber could exploit the flaw after identifying the vulnerable endpoint. Because the flaw requires authentication, defenders should monitor for unexpected database queries, but the absence of a publicly known exploit does not diminish the potential risk. The CVSS score of 7.7 indicates a high severity, reflecting the ability to compromise data integrity and confidentiality.