SQL Injection in Modern Events Calendar WordPress Plugin

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Modern Events Calendar Lite and Pro WordPress plugins before version 7.37.0 contain a critical SQL injection vulnerability (CWE-89) affecting authenticated users at Subscriber level and above. The vulnerability stems from insufficient input sanitization and escaping of parameters used in SQL statements, allowing attackers to append malicious SQL queries to legitimate database operations. This impacts any WordPress installation running vulnerable versions of these popular calendar plugins, potentially exposing sensitive database information including user credentials, private event data, and site configuration details. The low privilege requirement (Subscriber access) significantly lowers the barrier to exploitation, making this a high-risk vulnerability for multi-user WordPress environments.

Casky's security skills platform would detect attack patterns associated with this CVE by correlating 323 matching skills across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Persistence). Practitioners would observe findings related to reconnaissance activities through data exfiltration attempts via SQL query manipulation, and persistence techniques through potential database manipulation for backdoor establishment. The extended reasoning capabilities would identify suspicious parameter patterns in Modern Events Calendar plugin requests, anomalous SQL error messages in logs indicating query concatenation, and database access logs showing unusual query structures. Security teams would see alerts on SQL metacharacter injection attempts, authenticated but unusual database queries, and potential privilege escalation through information gathering—enabling detection of both active exploitation and reconnaissance activities targeting this specific vulnerability.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-102499.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-102499

Casky has 323 skills that investigate the attack patterns behind CVE-2026-102499. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn