CVE-2026-102499: Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action

Q: Which users can exploit this issue?

An authenticated WordPress user with the Subscriber role or any higher-privileged role can exploit it. Unauthenticated visitors are not identified as able to exploit it in the available information.

Q: What access does an attacker need to retrieve data?

The attacker needs a valid account at Subscriber level or above and must be able to invoke the mec_attendees AJAX action. Successful exploitation can append SQL queries to existing queries and extract sensitive database data.

Q: Which installations should be prioritized for remediation?

Modern Events Calendar Lite and Modern Events Calendar Pro installations running versions earlier than 7.37.0 are affected. Prioritize sites where Subscriber accounts can be created, obtained, or are assigned to untrusted users.

Q: How can I determine whether my site is affected?

Check whether either Modern Events Calendar Lite or Pro is installed, then verify its installed version. Versions before 7.37.0 are affected according to the provided information.

Published Oct 21, 2026

Updated

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.

Affected Software

2 affected components

Webnus Modern Events Calendar Lite<7.37.0

Webnus Modern Events Calendar Pro<7.37.0

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

An authenticated WordPress user with the Subscriber role or any higher-privileged role can exploit it. Unauthenticated visitors are not identified as able to exploit it in the available information.

What access does an attacker need to retrieve data?

The attacker needs a valid account at Subscriber level or above and must be able to invoke the mec_attendees AJAX action. Successful exploitation can append SQL queries to existing queries and extract sensitive database data.

Which installations should be prioritized for remediation?

Modern Events Calendar Lite and Modern Events Calendar Pro installations running versions earlier than 7.37.0 are affected. Prioritize sites where Subscriber accounts can be created, obtained, or are assigned to untrusted users.

How can I determine whether my site is affected?

Check whether either Modern Events Calendar Lite or Pro is installed, then verify its installed version. Versions before 7.37.0 are affected according to the provided information.

CVE-2026-102499: Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

What access does an attacker need to retrieve data?

Which installations should be prioritized for remediation?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What access does an attacker need to retrieve data?

Which installations should be prioritized for remediation?

How can I determine whether my site is affected?