{"id":"CVE-2026-102499","kind":"vulnerability","aliases":["CVE-2026-102499"],"related":[],"title":"Modern Events Calendar WordPress plugins: SQL injection lets subscribers read database","description":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.","summary":"The Modern Events Calendar Lite and Pro WordPress plugins before 7.37.0 pass a parameter into a SQL statement without sanitising or escaping it. A logged-in user with Subscriber access or higher can append their own SQL queries and extract sensitive data from the site database.","severity":"high","cvss":7.7,"epss":0.00282,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["no-subscriber-accounts","plugin-on-7.37.0-or-later","registration-closed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get modern-events-calendar-lite --field=version` and `wp plugin get modern-events-calendar --field=version`\n- Check whether Modern Event Calendar Pro is installed alongside the Lite plugin","fix":"- Update Modern Events Calendar Lite and Modern Event Calendar Pro to `7.37.0` or later\n- Review subscriber accounts for anything unexpected if the site ran an older version","status":"open","published_at":"2026-10-21T06:16:45+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:10:32+00:00","updated_at":"2026-10-25T03:10:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:10:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update Modern Events Calendar Lite and Modern Event Calendar Pro to `7.37.0` or later\n- Review subscriber accounts for anything unexpected if the site ran an older version","reach":"internet","title":"Modern Events Calendar WordPress plugins: SQL injection lets subscribers read database","impact":"high","summary":"The Modern Events Calendar Lite and Pro WordPress plugins before 7.37.0 pass a parameter into a SQL statement without sanitising or escaping it. A logged-in user with Subscriber access or higher can append their own SQL queries and extract sensitive data from the site database.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads sensitive database contents, including user credentials and site data","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get modern-events-calendar-lite --field=version` and `wp plugin get modern-events-calendar --field=version`\n- Check whether Modern Event Calendar Pro is installed alongside the Lite plugin","needs_analyst":false,"not_affected_if":["plugin-on-7.37.0-or-later","no-subscriber-accounts","registration-closed"],"who_is_affected":"Any WordPress site running Modern Events Calendar Lite or Modern Event Calendar Pro older than 7.37.0 that lets users register or has accounts at Subscriber level. Exposure depends on the plugin being active and on open or self-service registration; sites with no public registration and no subscriber accounts are much less exposed. Sites already on 7.37.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":3393,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102499':14A,17A '-2026':13A,16A '7.37.0':36B,81C,89C 'access':56B,112C 'addit':117C 'allow':105C 'alreadi':121C 'append':60B,116C 'authent':106C 'calendar':3A,29B,76C,84C 'cve':12A,15A 'data':68B,127C 'databas':11A,72B,130C 'escap':47B,94C 'event':2A,28B,75C,83C 'exist':122C 'extract':66B,125C 'higher':58B 'host':21B 'inject':7A 'let':8A 'level':111C 'lite':30B,77C 'log':51B 'logged-in':50B 'modern':1A,27B,74C,82C 'packag':18B 'paramet':39B,96C 'pass':37B 'plugin':5A,25B,34B,79C,87C 'pro':32B,85C 'queri':64B,119C,123C 'read':10A 'sanitis':45B,92C 'self':20B 'self-host':19B 'sensit':67B,126C 'site':71B 'sql':6A,42B,63B,102C,118C 'statement':43B,103C 'subscrib':9A,55B,110C 'subscriber-level':109C 'use':98C 'user':53B,107C 'without':44B 'wordpress':4A,22B,24B,33B,78C,86C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running Modern Events Calendar Lite or Modern Event Calendar Pro older than 7.37.0 that lets users register or has accounts at Subscriber level. Exposure depends on the plugin being active and on open or self-service registration; sites with no public registration and no subscriber accounts are much less exposed. Sites already on 7.37.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102499","severity":null,"published_at":"2026-10-21T06:16:45+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-102499","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102499","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}