CVE-2026-96534: Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export

Q: Which users can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. Sites that allow self-registration or provide low-privilege accounts to untrusted users have a more direct exposure.

Q: Which plugin versions need to be updated?

Modern Events Calendar Lite and Modern Events Calendar Pro versions earlier than 7.37.0 are affected. Update either edition to version 7.37.0 or later.

Q: What must an attacker be able to do?

The attacker needs an authenticated WordPress account with at least Subscriber privileges and must be able to reach the mec_fes_csv_export functionality. The issue is caused by an input parameter being used in a SQL statement without sanitization and escaping.

Published Oct 18, 2026

Updated

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.

Affected Software

2 affected components

Webnus Modern Events Calendar Lite<7.37.0

Webnus Modern Events Calendar Pro<7.37.0

Event History

Oct 18, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

Description

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. Sites that allow self-registration or provide low-privilege accounts to untrusted users have a more direct exposure.

Which plugin versions need to be updated?

Modern Events Calendar Lite and Modern Events Calendar Pro versions earlier than 7.37.0 are affected. Update either edition to version 7.37.0 or later.

What must an attacker be able to do?

The attacker needs an authenticated WordPress account with at least Subscriber privileges and must be able to reach the mec_fes_csv_export functionality. The issue is caused by an input parameter being used in a SQL statement without sanitization and escaping.

CVE-2026-96534: Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

Which plugin versions need to be updated?

What must an attacker be able to do?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

Which plugin versions need to be updated?

What must an attacker be able to do?