Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection

Vulnerability

The Modern Events Calendar Lite WordPress plugin versions before 5.16.6 contain an authenticated SQL injection vulnerability in the mec_fes_form AJAX action. The mec[post_id] POST parameter is not sanitized before being used in SQL queries. By default, the action requires author+ privileges, but if the Frontend Event Submission form is embedded on a public page, any authenticated user (including subscribers) can trigger the vulnerability [1].

Exploitation

An attacker must be logged in as an authenticated user (author+ by default, or any role if the form is publicly embedded). The attacker sends a crafted POST request to the mec_fes_form AJAX endpoint with a malicious value in the mec[post_id] parameter containing SQL injection payloads. No additional user interaction is required beyond being authenticated [1].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL queries against the WordPress database. This can lead to data exfiltration (e.g., user credentials, posts, options), data modification, or deletion, potentially resulting in privilege escalation or full site compromise [1].

Mitigation

The vulnerability is fixed in version 5.16.6 of the plugin. Users should update to this version or later immediately. No workarounds are documented. The plugin is actively maintained, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog [1].