CVE-2026-109901

8.5High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.5High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-89

Impact

Authenticated attackers can execute arbitrary SQL queries against the database to extract sensitive data or degrade database availability. They need network access to the WordPress site and valid low-privileged credentials.

Root cause

User-supplied input is not properly neutralized before being concatenated into SQL commands.

Affected systems

Codepeople CP Multi View Event Calendar (cp-multi-view-calendar) through 1.4.41

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Fix & remediation

Upgrade CP Multi View Event Calendar to a version newer than 1.4.41 once available, or deactivate and delete the plugin immediately if an update is not yet published.

shell

$ wp plugin deactivate cp-multi-view-calendar

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41.

References

https://patchstack.com/database/wordpress/plugin/cp-multi-view-calendar/vulnerability/wordpress-cp-multi-view-event-calendar-plugin-1-4-41-sql-injection-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-109901