CVE-2026-11349— Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Modern Event Calendar Pro | < 7.34.0 | affected |
| Unknown | Modern Events Calendar Lite | < 7.34.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-11349
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more
Source: CVE Program / CVE List V5
Vulnerability Description
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Modern Events Calendar Lite SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Modern Events Calendar Lite是WordPress基金会的一款事件日历管理插件。 WordPress Modern Events Calendar Lite 7.34.0之前版本存在SQL注入漏洞，该漏洞源于未对请求参数进行清理和转义，直接用于SQL语句，且通过未认证用户可访问的AJAX动作触发，可能导致未认证的SQL注入攻击，允许攻击者从数据库中提取敏感数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Modern Event Calendar Pro | 0 ~ 7.34.0 | - | |
| Unknown | Modern Events Calendar Lite | 0 ~ 7.34.0 | - |
II. Public POCs for CVE-2026-11349
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11349
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-11349 (1)
Same Patch Batch · Unknown · 2026-07-20 · 18 CVEs total
| CVE-2026-12973 | PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Mo | |
| CVE-2026-8825 | Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API | |
| CVE-2026-13156 | MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation | |
| CVE-2026-13147 | Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis | |
| CVE-2026-13142 | Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email O | |
| CVE-2026-13432 | ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation | |
| CVE-2026-9833 | Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter | |
| CVE-2026-12898 | All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File W | |
| CVE-2026-12970 | LearnPress < 4.4.1 - Reflected XSS via c_search | |
| CVE-2026-10755 | All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration | |
| CVE-2026-12972 | PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering | |
| CVE-2026-12724 | Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-p | |
| CVE-2026-12723 | Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via | |
| CVE-2026-12592 | SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header | |
| CVE-2026-11868 | WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation | |
| CVE-2026-10081 | Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews | |
| CVE-2026-10724 | Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Rev |
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-14832
ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated - CVE-2026-13700
WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery - CVE-2026-19726
Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configura - CVE-2026-19728
Extra Product Options Builder for WooCommerce < 1.2.176 - Un - CVE-2026-19725
WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path
V. Comments for CVE-2026-11349
No comments yet