{"id":"CVE-2026-11349","aliases":["EUVD-2026-45879","GHSA-cqmp-4w3x-r378"],"status":"published","title":"Modern Events Calendar (Lite \u0026 Pro) \u003c 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more","description":"The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00497,"percentile":0.43104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2026-07-20T06:00:02Z","modified":"2026-07-20T20:39:31Z","exploits":[{"source":"pocgithub","id":"Hann1bl3L3ct3r/CVE-2026-11349","title":"Hann1bl3L3ct3r/CVE-2026-11349","date":"2026-06-05","url":"https://github.com/Hann1bl3L3ct3r/CVE-2026-11349"}],"products":[{"vendor":"unknown","product":"modern event calendar pro"},{"vendor":"unknown","product":"modern events calendar lite"},{"vendor":"webnus/","product":"modern events calendar lite"}],"references":[{"url":"https://wpscan.com/vulnerability/572229cb-8a09-406d-8623-7d6b553bfdde/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11349"},{"url":"https://wpscan.com/vulnerability/572229cb-8a09-406d-8623-7d6b553bfdde"},{"url":"https://github.com/advisories/GHSA-cqmp-4w3x-r378"}],"sources":{"cve":[{"id":"CVE-2026-11349","title":"Modern Events Calendar (Lite \u0026 Pro) \u003c 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more","description":"The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.","status":"published","published":"2026-07-20T06:00:02.457Z","modified":"2026-07-20T13:16:15.469Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:20:05.15083Z"}],"euvd":[{"id":"EUVD-2026-45879","description":"The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.","status":"published","published":"2026-07-20T06:00:02Z","modified":"2026-07-20T13:16:15Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:49.035342Z"}],"ghsa":[{"id":"GHSA-cqmp-4w3x-r378","title":"The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite...","description":"The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.","status":"published","published":"2026-07-20T09:31:07Z","modified":"2026-07-20T15:33:07Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:09:36.920272Z"}],"nvd":[{"id":"CVE-2026-11349","description":"The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.","status":"published","published":"2026-07-20T07:16:34.547Z","modified":"2026-07-20T20:39:31.217Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:31.024898Z"}]}}