CVE-2026-11349

HIGH8.6

Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more

Published Jul 20, 2026

Modified 2 months ago

Details

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.

References

DETECTION

https://wpscan.com/vulnerability/572229cb-8a09-406d-8623-7d6b553bfdde/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-11349

CVSS Analysis

CVSS v3.1

8.6

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

8.6/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Ecosystems

Timeline

PublishedJul 20, 2026

ModifiedJul 20, 2026