CVE-2026-109901: WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Codepeople CP Multi View Event Calendarto a version that resolves this vulnerability.Fixed in 1.4.42
Event History
Frequently Asked Questions
Which installations are affected?
The affected product is CodePeople CP Multi View Event Calendar, with versions through 1.4.41 affected. The available data does not identify a fixed version.
What access does an attacker need to exploit this issue?
The CVSS vector indicates network-reachable exploitation with low attack complexity, no user interaction, and low privileges required. This means an attacker must have an account or other low-privileged access path; unauthenticated exploitation is not indicated by the provided vector.
What is the potential impact?
Successful exploitation may expose highly sensitive information and can cause a limited availability impact. The CVSS vector indicates the impact can extend beyond the vulnerable plugin's security authority, while integrity impact is rated as none.