{"id":"CVE-2026-102499","title":"Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action","summary":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Sub…","severity":"none","cwe":["CWE-89"],"product":"Modern Events Calendar Lite","affected":["modern_events_calendar_lite < 7.37.0","modern_event_calendar_pro < 7.37.0"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T06:00:16.646Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102499","references":[{"url":"https://wpscan.com/vulnerability/adf388fb-21c9-4310-95b3-b9065ca51480/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T06:42:48.189Z","slug":"CVE-2026-102499","body":"## Overview\n\nThe Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.\n\n## Affected\n\n- `modern_events_calendar_lite < 7.37.0`\n- `modern_event_calendar_pro < 7.37.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}