{"id":"CVE-2026-96534","kind":"vulnerability","aliases":["CVE-2026-96534"],"related":[],"title":"WordPress Modern Events Calendar plugins: SQL injection by any logged-in user","description":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.","summary":"The Modern Events Calendar Lite and Pro WordPress plugins build a SQL statement from an unsanitised, unescaped parameter. An authenticated user with the lowest role (Subscriber) can inject SQL to read or change the site database.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["no-plugin-installed","plugin-version-7.37.0-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/modern-events-calendar-lite/` and `wp-content/plugins/modern-event-calendar-pro/`\n- Look at the plugin's main file header for the `Version:` line and compare it with the fixed version\n- Confirm whether open subscriber registration is enabled under Settings > General > Membership","fix":"- Update Modern Events Calendar Lite and Modern Event Calendar Pro to `7.37.0` or later\n- If an update cannot be applied right away, restrict or disable new user registration so only trusted accounts can log in","status":"open","published_at":"2026-10-18T07:16:53+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:10:58+00:00","updated_at":"2026-10-25T03:10:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:10:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update Modern Events Calendar Lite and Modern Event Calendar Pro to `7.37.0` or later\n- If an update cannot be applied right away, restrict or disable new user registration so only trusted accounts can log in","reach":"internet","title":"WordPress Modern Events Calendar plugins: SQL injection by any logged-in user","impact":"high","summary":"The Modern Events Calendar Lite and Pro WordPress plugins build a SQL statement from an unsanitised, unescaped parameter. An authenticated user with the lowest role (Subscriber) can inject SQL to read or change the site database.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads or alters the WordPress database, including user credentials","analyst_note":"Find the vulnerable endpoint and parameter from the NVD entry or the plugin changelog to confirm the exact exposure and whether open subscriber registration is default.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/modern-events-calendar-lite/` and `wp-content/plugins/modern-event-calendar-pro/`\n- Look at the plugin's main file header for the `Version:` line and compare it with the fixed version\n- Confirm whether open subscriber registration is enabled under Settings > General > Membership","needs_analyst":true,"not_affected_if":["plugin-version-7.37.0-or-later","no-plugin-installed"],"who_is_affected":"Sites running the Lite or Pro version of the plugin before 7.37.0 are exposed, and the risk is highest where anyone can register or hold a Subscriber account. Sites with no open registration and no untrusted accounts have a much smaller exposure, but the plugin should still be updated. The sources do not say which specific feature or endpoint carries the flawed parameter.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000693,"input_tokens":3343,"output_tokens":718,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-96534':16A,19A '7.37.0':73C,81C 'allow':96C 'attack':109C 'authent':48B,97C 'build':38B 'calendar':4A,32B,68C,76C 'chang':61B 'cve':14A,17A 'databas':64B 'escap':86C 'event':3A,31B,67C,75C 'host':24B 'inject':7A,56B,108C 'lite':33B,69C 'log':11A 'logged-in':10A 'lowest':52B 'minim':100C 'modern':2A,30B,66C,74C 'packag':20B 'paramet':46B,88C 'perform':106C 'php':21B 'plugin':5A,28B,37B,71C,79C 'privileg':101C 'pro':35B,77C 'read':59B 'role':53B 'sanitis':84C 'self':23B 'self-host':22B 'site':63B 'sql':6A,40B,57B,94C,107C 'statement':41B,95C 'subscrib':54B,102C 'unescap':45B 'unsanitis':44B 'use':90C 'user':13A,49B,98C 'wordpress':1A,25B,27B,36B,70C,78C 'wordpress-plugin':26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Lite or Pro version of the plugin before 7.37.0 are exposed, and the risk is highest where anyone can register or hold a Subscriber account. Sites with no open registration and no untrusted accounts have a much smaller exposure, but the plugin should still be updated. The sources do not say which specific feature or endpoint carries the flawed parameter.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96534","severity":null,"published_at":"2026-10-18T07:16:53+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}