CVE-2026-11349
Deferred Deferred - Pending Action

Unauthenticated SQL Injection in Modern Event Calendar Pro

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: WPScan

Description
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-11349
EUVD
EUVD-2026-45879

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
modern_events_calendar pro to 7.34.0 (exc)
modern_events_calendar lite to 7.34.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated SQL injection vulnerability in the Modern Event Calendar Pro and Lite WordPress plugins before version 7.34.0. The flaw occurs because user input is not properly sanitized or escaped before being used in SQL queries through an AJAX action accessible without authentication. Attackers can exploit this to extract sensitive data from the database.

Detection Guidance

To detect this vulnerability, check the installed versions of Modern Events Calendar Lite or Pro. If the version is below 7.34.0, the system is vulnerable. Use WordPress admin panel or run the command: wp plugin list | grep 'modern events calendar' in a terminal with WordPress CLI access.

Impact Analysis

If you use an affected version of the Modern Event Calendar Pro or Lite plugin, attackers could exploit this vulnerability to access sensitive data stored in your WordPress database, such as user credentials, personal information, or other confidential data. This could lead to data breaches, unauthorized access, or further attacks on your site.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR or HIPAA, as it may result in unauthorized access to or exposure of personal or protected health information. Organizations could face legal penalties, fines, or reputational damage if such a breach occurs due to inadequate security measures.

Mitigation Strategies

Immediately update Modern Events Calendar Lite or Pro to version 7.34.0 or later. If updating is not possible, disable the plugin temporarily until the update is applied to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11349. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart