Live › vulnerability › CVE-2026-102499
Go to dashboardThe Modern Events Calendar Lite and Pro WordPress plugins before 7.37.0 pass a parameter into a SQL statement without sanitising or escaping it. A logged-in user with Subscriber access or higher can append their own SQL queries and extract sensitive data from the site database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any WordPress site running Modern Events Calendar Lite or Modern Event Calendar Pro older than 7.37.0 that lets users register or has accounts at Subscriber level. Exposure depends on the plugin being active and on open or self-service registration; sites with no public registration and no subscriber accounts are much less exposed. Sites already on 7.37.0 or later are not affected.
No product ranges from the sources yet.
wp plugin get modern-events-calendar-lite --field=version and wp plugin get modern-events-calendar --field=version7.37.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.
This page as .md · .json · in your agent: get_signal("CVE-2026-102499")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.