Overview
CVE-2026-102499 is a SQL injection vulnerability in the Modern Events Calendar Lite and Modern Events Calendar Pro WordPress plugins. A request parameter is used in a SQL statement without being sanitized or escaped, so any authenticated user with Subscriber-level access or above can append additional SQL queries.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-102499 |
| CVSS Score | 7.7 (High) |
| Affected Software | Modern Events Calendar Lite and Pro WordPress plugins |
| Affected Versions | Before 7.37.0 |
| Fixed Version | 7.37.0 |
| Attack Vector | Network |
| Authentication Required | Yes, Subscriber role or higher |
| Published | October 21, 2026 |
Technical Details
The plugin passes an unsanitized parameter into a database query. Because the lowest default WordPress role (Subscriber) is enough to reach the vulnerable code path, the effective barrier to exploitation is low on any site that allows open registration.
Typical exploitation of this class of flaw includes:
- Data extraction using UNION-based or blind (boolean and time-based) techniques
- Credential theft by reading password hashes and user metadata from the WordPress user tables
- Data tampering if the database account permits writes
No public exploit code or in-the-wild exploitation was reported in the source advisory at the time of writing.
Impact
- Disclosure of database contents, including user records and any plugin or site secrets stored in the options table
- Potential escalation to administrator through hash cracking or tampering with user data
- Elevated risk for sites with public registration, membership or event-booking features that hand out Subscriber accounts freely
Affected Versions
| Product | Version | Status |
|---|---|---|
| Modern Events Calendar Lite | before 7.37.0 | Vulnerable |
| Modern Events Calendar Pro | before 7.37.0 | Vulnerable |
| Modern Events Calendar Lite / Pro | 7.37.0 and later | Fixed |
Remediation
- Update both Modern Events Calendar Lite and Pro to 7.37.0 or later.
- Review registered users and remove unknown Subscriber accounts, especially recent sign-ups.
- Disable open registration (Settings, General, Membership) if it is not needed.
- Deploy a WAF with SQL injection rules in front of the site as a stopgap.
- Check logs for unusual requests from low-privilege accounts to plugin endpoints, and rotate credentials if you suspect data was read.
- Apply least privilege to the WordPress database account.