Description

Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-18T15:17:02.480Z",
  "pubdate": "2026-08-18T15:17:02.480Z",
  "executiveSummary": "An unauthenticated SQL Injection vulnerability has been identified in Modern Events Calendar versions prior to 7.35.0. This security flaw allows remote, unauthenticated attackers to manipulate database queries by injecting malicious SQL payloads into vulnerable input parameters processed by the application.\nThe primary impact of this vulnerability includes unauthorized database access, potential extraction of sensitive information such as user credentials and application data, and possible remote code execution or database compromise depending on underlying database permissions and configurations.\nThe affected product is Modern Events Calendar across all versions preceding 7.35.0. The risk implications are severe, as exploitation requires no prior authentication or administrative privileges, lowering the barrier to entry for malicious threat actors targeting internet-facing web applications.\nAttackers can leverage this flaw autonomously over the network via standard HTTP requests without interacting with legitimate users. Remediation requires updating the Modern Events Calendar plugin to version 7.35.0 or later, where input sanitization and parameterized queries are properly implemented to neutralize SQL injection vectors.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and improper sanitization of user-supplied parameters within the Modern Events Calendar plugin prior to version 7.35.0. Specifically, user input is directly concatenated into dynamic SQL queries without utilizing prepared statements or parameterized queries, violating secure coding principles for database interactions.\nExploitation occurs over the network via HTTP GET or POST requests where an unauthenticated attacker supplies specially crafted SQL syntax within vulnerable parameters processed by the plugin's backend logic. When the application executes the malformed query against the underlying database management system, the injected SQL commands are interpreted and executed within the context of the database user account.\nThe attack flow proceeds as follows: First, the attacker identifies a vulnerable endpoint or parameter handled by Modern Events Calendar. Second, the attacker crafts a malicious payload incorporating SQL operators such as UNION, SLEEP, or stacked queries to extract data, infer database structures through error-based techniques, or induce time-based delays. Third, the HTTP request containing the payload is transmitted to the server. Fourth, the vulnerable PHP component processes the input and constructs an insecure SQL query string. Fifth, the database executes the resulting query, returning sensitive records or executing unauthorized operations back to the application or directly to the attacker.\nNetwork exposure is fully remote, as the vulnerable endpoints are accessible over standard web protocols (HTTP/HTTPS) without requiring any prior authentication requirements or privilege requirements. The post-exploitation impact ranges widely depending on the database user privileges, potentially allowing full read and write access to application databases, enumeration of administrative accounts, and escalation to server-level compromise."
}