A critical SQL injection vulnerability in the Modern Event Calendar Pro WordPress plugin allows unauthenticated attackers to perform unauthorized database operations.

This vulnerability is a SQL injection flaw (CWE-89) that permits an unauthenticated attacker to inject malicious SQL queries. The flaw originates from insufficient input sanitization within the plugin, enabling remote attackers to access backend database contents.

The ability for an unauthenticated user to interact with the underlying database poses a severe risk of data exfiltration, including user credentials and sensitive business information. With a CVSS score of 8.6, this vulnerability facilitates unauthorized access to critical infrastructure, potentially leading to a complete compromise of the WordPress site database.

Immediate Action: Update the Modern Event Calendar Pro and Modern Events Calendar Lite plugins to version 7.34.0 or higher immediately.

Proactive Monitoring: Monitor database query logs for anomalous syntax or unexpected high volumes of requests originating from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns until the plugin can be patched.

Public Exploit Available: Yes, a public proof of concept is available via GitHub.

Given the availability of a public proof of concept and the high CVSS score, organizations using the Modern Event Calendar Pro plugin must prioritize this update. Immediate patching is required to prevent potential unauthorized data access and maintain the integrity of the WordPress application environment.