CVE-2026-105067: WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
modern-events-calendar-liteto a version that resolves this vulnerability.Fixed in 7.37.0
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Any site running Modern Events Calendar Lite below version 7.37.0 should be treated as affected. The vulnerability has high severity and can expose data through blind SQL injection.
What level of access does an attacker need?
The CVSS vector indicates that exploitation is network-reachable, requires low privileges, and does not require user interaction. This means unauthenticated visitors are not indicated as sufficient; an attacker needs some level of existing privileges.
How can I check whether a site is affected?
Check the installed version of the Modern Events Calendar Lite plugin. Versions earlier than 7.37.0 are affected, while the issue is specified as affecting releases before 7.37.0.
What is the available remediation?
Update Modern Events Calendar Lite to version 7.37.0 or later. The provided information does not identify a configuration workaround or other temporary mitigation.