PT-2026-61522 · WordPress · Modern Event Calendar Pro+1

Anthony Cihan · CVE-2026-11349 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Modern Event Calendar Pro versions prior to 7.34.0 Modern Events Calendar Lite versions prior to 7.34.0

Description An unauthenticated SQL injection exists due to improper sanitization and escaping of a request parameter used in a SQL statement. This issue occurs through an AJAX action accessible to unauthenticated users, which could allow an attacker to extract sensitive data from the database.

Recommendations Update Modern Event Calendar Pro to version 7.34.0 or later. Update Modern Events Calendar Lite to version 7.34.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-11349

Affected Products

Modern Event Calendar Pro

Modern Events Calendar Lite

References · 3

• 🔥 https://wpscan.com/vulnerability/572229cb-8a09-406d-8623-7d6b553bfdde · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-11349 · Security Note
• https://twitter.com/VulmonFeeds/status/2079153471329087700 · Twitter Post