CVE-2026-11349: Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11349?
The severity of CVE-2026-11349 is rated high with a CVSS score of 8.6.
How do I fix CVE-2026-11349?
To fix CVE-2026-11349, update the Modern Events Calendar plugin to version 7.34.0 or later.
What type of vulnerability is CVE-2026-11349?
CVE-2026-11349 is an unauthenticated SQL injection vulnerability.
Who is affected by CVE-2026-11349?
CVE-2026-11349 affects users of the Modern Events Calendar Pro and Lite plugins prior to version 7.34.0.
Can CVE-2026-11349 be exploited remotely?
Yes, CVE-2026-11349 can be exploited remotely as it allows unauthenticated users to perform SQL injection.