Modern Events Calendar Lite plugin: Blind SQL injection
Summary
The WordPress plugin Modern Events Calendar Lite before version 7.37.0 contains a blind SQL injection vulnerability (CWE-89). An attacker with a low-privileged account, such as a Subscriber, can send crafted input to the database and may read, modify or delete data, including user accounts. Exploitation is not known to be active, and the NVD analysis is still pending.
Affected
- Modern Events Calendar Lite (WordPress plugin) all versions before 7.37.0
- Required privilege: low (per CVSS vector PR:L; Patchstack lists Subscriber)
Fixed in
- Version 7.37.0 or later
Workaround
- No workaround is documented in the sources.
- Until the update is applied, restrict or disable open user registration and review accounts with login rights.
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV.
- No public proof-of-concept found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- Patchstack rates the issue as high priority and expects exploitation, based on its own assessment.
Our recommendation
- Inventory WordPress sites running Modern Events Calendar Lite or Pro and record their versions.
- Update to version 7.37.0 or later, including the Pro edition if installed. Fix the other SQL injection CVEs in the same versions (CVE-2026-96534, CVE-2026-102499) with the same update.
- Check whether subscriber or open registration is enabled and review accounts that can log in.
- Consider a web application firewall as an interim measure while the update is pending.
- Monitor the Patchstack page and NVD for changes to the status and CVSS score.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB entry CVE-2026-105067 vuldb.com
- Vulners VulnRichment CVE-2026-105067 vulners.com
- Strix CVE-2026-105067 www.strix.ai
- CVE threatint record CVE-2026-105067 cve.threatint.com
- CVE threatint record CVE-2026-96534 cve.threatint.com
- Strix CVE-2026-102499 www.strix.ai
- GitHub repository Modern Events Calendar Lite github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:37.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.