CVE-2026-96534 Modern Events Calendar CVE debrief

Who should care

WordPress administrators and security teams responsible for maintaining and securing WordPress installations using the affected plugins should be aware of this vulnerability. They should assess exposure, prioritize remediation, and verify plugin versions to prevent exploitation. This includes reviewing compensating controls and monitoring for potential security incidents related to this vulnerability.

Why it matters

CVE-2026-96534 is a SQL injection vulnerability in the Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins. Authenticated users with minimal privileges can exploit this vulnerability, potentially leading to unauthorized data access or modification. WordPress administrators and security teams should assess exposure, prioritize remediation, and verify plugin versions to prevent exploitation.

• Authenticated users can exploit this vulnerability to perform SQL injection attacks
• Successful exploitation may lead to unauthorized data access or modification
• Remediation priority is high due to the potential for data breaches
• Verification of plugin versions and updates is necessary to prevent exploitation

Technical summary

The Modern Events Calendar Lite WordPress plugin before 7.37.0 and Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks. This vulnerability can lead to unauthorized data access or modification. The issue is addressed in version 7.37.0 of both plugins. WordPress administrators and security teams should assess exposure and prioritize remediation.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the affected plugins.

Recommended defensive actions

• Assess WordPress installations for exposure to CVE-2026-96534
• Prioritize remediation for affected plugins
• Verify plugin versions and apply updates
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows authenticated users to perform SQL injection attacks due to unsanitized and unescaped parameters in SQL statements. This issue affects the Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before version 7.37.0. Evidence is based on CVE Program records and NVD vulnerability details. Defenders should verify plugin versions and assess exposure to this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.