CVE-2026-96534
7.7HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-89
Impact
Authenticated users with at least Subscriber privileges can extract data from the database via SQL injection. Network access and valid low-level credentials are required.
Root cause
The plugin fails to sanitize and escape a user-supplied parameter before executing it in a SQL query.
Affected systems
Modern Events Calendar Lite and Modern Event Calendar Pro plugins before version 7.37.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Fix & remediation
Upgrade Modern Events Calendar Lite or Pro to version 7.37.0 or later. If patching immediately is not possible, deactivate the plugin or revoke subscriber access.
$ wp plugin update modern-events-calendar-lite --version=7.37.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.