CVE-2026-11349 – Unauthenticated SQL Injection – Modern Events Calendar (Pro & Lite) before 7.34.0

Summary

CVE-2026-11349 is a high-severity unauthenticated SQL injection vulnerability affecting the Modern Events Calendar Pro and Modern Events Calendar Lite WordPress plugins in all versions prior to 7.34.0. The flaw allows any unauthenticated remote attacker to inject arbitrary SQL and extract sensitive data from the WordPress database, with no credentials or user interaction required. This vulnerability carries a CVSS v3.1 base score of 8.6 (HIGH) with scope change, reflecting the potential for database-wide data exfiltration.

Technical details

• Root cause: The plugins’ sanitize_deep_array() helper function is a no-op when called without its optional $excludes parameter — due to flawed boolean logic, all input values pass through unsanitized. Multiple load_more() AJAX handlers call this function incorrectly, then directly concatenate the unsanitized values into SQL IN (...) / NOT IN (...) clauses via implode(). No prepared statement ($wpdb->prepare()) is used, and no nonce validation is enforced.
• Trigger conditions: The vulnerable AJAX actions are registered on WordPress wp_ajax_nopriv_* hooks, making them accessible without any authentication. Affected actions include mec_list_load_more, mec_grid_load_more, mec_masonry_load_more, mec_agenda_load_more, mec_timeline_load_more, mec_tile_load_more, and mec_custom_load_more.
• Vulnerable parameters: atts[include][] and atts[exclude][] passed via HTTP request to wp-admin/admin-ajax.php.
• Attack vector: Remote, unauthenticated HTTP request to a standard WordPress AJAX endpoint — no special access, network position, or preconditions required.
• Impact: A time-based blind SQL injection technique allows an attacker to enumerate and extract the full WordPress database contents, including user password hashes (wp_users), secret keys and salts (wp_options), personally identifiable information, and other sensitive plugin/theme data. Exploitation occurs in a read-only SELECT context; stacked write queries are not supported by this injection point.
• Public PoC: A proof-of-concept exploit is publicly available, including an automated extraction tool and a vulnerability scanner targeting this specific injection chain.

Affected software

• Modern Event Calendar Pro — all versions before 7.34.0
• Modern Events Calendar Lite — all versions before 7.34.0

Severity

CVSS v3.1 Base Score: 8.6 (HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

| Metric | Value |
|—|—|
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity | None |
| Availability | None |

Mitigation and recommended actions

• Immediate action — patch now: Update both plugins to version 7.34.0 or later. The fix is available from the Webnus vendor distribution channel (mec.webnus.net). Note that the Lite version was removed from the wordpress.org plugin repository in 2022 and is now distributed exclusively through the Webnus website.
• If immediate patching is not feasible: Restrict unauthenticated access to wp-admin/admin-ajax.php at the web server or WAF layer for external clients, or disable the affected "load more" skin features until the patch can be applied. Monitor database query logs for anomalous SLEEP() or BENCHMARK() patterns in queries against wp_mec_dates.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-11349 at NIST
• WPScan Vulnerability Advisory