{"id":"CVE-2026-102499","aliases":["EUVD-2026-107049","GHSA-rxf7-qp8j-cx93"],"status":"published","title":"Modern Events Calendar (Lite \u0026 Pro) \u003c 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action","description":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00366,"percentile":0.30623,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-10-21T06:00:16Z","modified":"2026-10-21T18:37:38Z","products":[{"vendor":"unknown","product":"modern event calendar pro"},{"vendor":"unknown","product":"modern events calendar lite"},{"vendor":"webnus/","product":"modern events calendar lite"}],"references":[{"url":"https://wpscan.com/vulnerability/adf388fb-21c9-4310-95b3-b9065ca51480/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102499"},{"url":"https://wpscan.com/vulnerability/adf388fb-21c9-4310-95b3-b9065ca51480"},{"url":"https://github.com/advisories/GHSA-rxf7-qp8j-cx93"}],"sources":{"cve":[{"id":"CVE-2026-102499","title":"Modern Events Calendar (Lite \u0026 Pro) \u003c 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action","description":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.","status":"published","published":"2026-10-21T06:00:16.646Z","modified":"2026-10-21T10:35:09.296Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:38:54.394896Z"}],"euvd":[{"id":"EUVD-2026-107049","description":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.","status":"published","published":"2026-10-21T06:00:16Z","modified":"2026-10-21T10:35:09Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:59:39.717973Z"}],"ghsa":[{"id":"GHSA-rxf7-qp8j-cx93","title":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro...","description":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.","status":"published","published":"2026-10-21T06:31:14Z","modified":"2026-10-21T12:32:07Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:14:09.697532Z"}],"nvd":[{"id":"CVE-2026-102499","description":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.","status":"published","published":"2026-10-21T06:16:45.713Z","modified":"2026-10-21T18:37:38.7Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:13:02.045979Z"}]}}