Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection

Vulnerability

The Modern Events Calendar Lite WordPress plugin before version 6.1.5 fails to sanitize and escape the time parameter before using it in a SQL statement within the mec_load_single_page AJAX action. This action is available to unauthenticated users, making the vulnerability exploitable without any prior privileges [2][1].

Exploitation

An unauthenticated attacker can send a crafted AJAX request to the vulnerable endpoint with a malicious time parameter containing SQL injection payloads. The attacker does not need authentication or special network position beyond normal web access. Proof-of-concept exploit code is publicly available [1][3].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL queries against the WordPress database, potentially leading to extraction of sensitive data such as user credentials, post content, and other stored information. This can result in complete information disclosure and possible further compromise of the site [2].

Mitigation

The vulnerability is fixed in version 6.1.5 of the plugin, released on 2021-11-15. Users should update immediately to this version or later. The plugin is listed on WordPress.org and no workaround other than updating is available [2].