CVE-2026-73339: Modern Events Calendar SQLi Vulnerability

CVE-2026-73339 Overview

CVE-2026-73339 is an unauthenticated SQL injection vulnerability in the Modern Events Calendar plugin for WordPress. The flaw affects all versions prior to 7.35.0. Attackers can send crafted HTTP requests over the network without credentials or user interaction. Successful exploitation allows injection of arbitrary SQL statements into backend database queries. The vulnerability maps to [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can inject SQL commands against WordPress sites running vulnerable Modern Events Calendar installations, exposing database contents and impacting site availability.

Affected Products

Modern Events Calendar plugin for WordPress
All versions prior to 7.35.0
WordPress sites with the plugin installed and network-reachable

Discovery Timeline

2026-08-18 - CVE-2026-73339 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73339

Vulnerability Analysis

The vulnerability resides in the Modern Events Calendar plugin, a widely deployed WordPress event management extension. An unauthenticated attacker can supply malicious input to a plugin endpoint that flows into a SQL query without proper neutralization. The scope is marked as changed, indicating the injected SQL context can affect resources beyond the initial vulnerable component. Confidentiality impact is high, allowing extraction of stored WordPress data including user records, session tokens, and plugin configuration. Availability impact is low, reflecting query manipulation that can degrade database responsiveness.

Root Cause

The root cause is failure to properly sanitize or parameterize user-controlled input before concatenating it into a SQL statement. The plugin processes request parameters and passes them into database queries without using prepared statements or the WordPress $wpdb->prepare() API. This categorizes the flaw under [CWE-89].

Attack Vector

Exploitation occurs remotely over HTTP or HTTPS. No authentication is required, and no user interaction is needed. An attacker sends a crafted request containing SQL metacharacters to a vulnerable plugin endpoint. The injected payload alters the intended query structure. Details of the specific vulnerable parameter are documented in the Patchstack SQL Injection Report.

No verified proof-of-concept code is publicly available. The vulnerability mechanism follows standard SQL injection patterns where untrusted input reaches a database query without proper escaping. Refer to the vendor advisory linked above for technical specifics.

Detection Methods for CVE-2026-73339

Indicators of Compromise

HTTP requests to Modern Events Calendar plugin endpoints containing SQL metacharacters such as UNION SELECT, SLEEP(, --, or encoded variants
Unexpected outbound database errors or unusually long response times from /wp-admin/admin-ajax.php or plugin-specific routes
New or modified WordPress administrator accounts appearing without a corresponding admin session

Detection Strategies

Inspect web server access logs for requests targeting Modern Events Calendar endpoints with suspicious query parameters
Enable WordPress database query logging and alert on queries containing tautologies such as OR 1=1 or stacked UNION clauses
Deploy a web application firewall rule set that flags SQL injection signatures against plugin URIs

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized analytics platform for correlation
Monitor the wp_users and wp_options tables for unauthorized writes following plugin request activity
Track plugin version inventory to identify hosts still running Modern Events Calendar below 7.35.0

How to Mitigate CVE-2026-73339

Immediate Actions Required

Update Modern Events Calendar to version 7.35.0 or later on all WordPress sites
Audit web server logs for evidence of exploitation prior to patching
Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected
Review the wp_users table for unauthorized accounts and remove any that are unrecognized

Patch Information

The vendor has released Modern Events Calendar 7.35.0, which remediates the SQL injection flaw. Refer to the Patchstack SQL Injection Report for advisory details and the fixed version.

Workarounds

Temporarily deactivate the Modern Events Calendar plugin until the update is applied
Restrict access to plugin endpoints using web application firewall rules that block SQL injection payloads
Limit database user privileges assigned to the WordPress application to reduce the blast radius of successful injection

bash

# Update Modern Events Calendar using WP-CLI
wp plugin update modern-events-calendar-lite --version=7.35.0
wp plugin list --name=modern-events-calendar-lite --fields=name,status,version