Published October 21, 2026. Based on public reports available on that date; details may change.
CVE-2026-102499 is an SQL injection vulnerability in Modern Events Calendar Lite and Pro before version 7.37.0. A WordPress account with Subscriber-level access or higher may be able to append database queries through a parameter used in an SQL statement. Update every affected Lite or Pro installation to 7.37.0 or later, then review accounts that should not have access to the site.
What happened
The reported problem is that an input used in an SQL statement was not sanitized and escaped before the statement ran. SQL is the language WordPress uses to read and write information in its database. When a plugin accepts input without handling it safely, an authenticated user may be able to change what the database query does.
For this issue, the public record says a Subscriber-level or higher account can append SQL queries and extract sensitive database data. Subscriber is commonly treated as a low-privilege role, but it is still an authenticated account. That means a site should not dismiss this update simply because it has few administrators.
The cited records do not report exploitation in the wild. They also do not establish that every affected site was accessed. Treat the notice as a patching and account-review task, rather than as evidence that a compromise occurred.
Who is affected
Modern Events Calendar Lite and Modern Events Calendar Pro versions before 7.37.0 are affected according to the public record. Version 7.37.0 is the update point to use for both editions.
Start by identifying which edition is installed and the version currently active. In the WordPress dashboard, open Plugins, find the Modern Events Calendar entry, and record its version before changing anything. A staging site, if you use one, should be checked too. It can remain exposed when only the production site is updated.
If you have command-line access, run this from the WordPress installation directory:
wp plugin list --format=table
The command lists installed plugins and their versions. Keep the output with your maintenance notes. It makes it easier to confirm that the update actually completed and to compare production, staging, and any other site using the plugin.
How to check accounts and database exposure
The first practical check is your user list. In the dashboard, go to Users, then look for Subscriber accounts and any role above Subscriber that you do not recognize. Do not assume a familiar-looking username is legitimate. Confirm the person, their email address, and whether they still need access.
WP-CLI can show the accounts in a compact list:
wp user list --fields=ID,user_login,user_email,roles,user_registered --format=table
Save a copy of this output before removing or changing an account. If you find an unexpected user, change the passwords of administrators and other privileged users, remove access only after preserving the details you need, and check whether the account was created for a real business purpose.
This CVE describes possible database-data extraction. It does not tell you which data, if any, was read on a particular site. Review the plugin and WordPress access history that your host or security tooling retains, with particular attention to unfamiliar authenticated activity. Do not rely on an absence of visible site changes as proof that no data was accessed.
What to do now
The essential action is to install version 7.37.0 or later for the affected edition. Take a current backup of the WordPress files and database first, and make sure you know how to restore it. A backup is a recovery point, not a substitute for applying the update.
In the dashboard, use Dashboard, Updates or Plugins, then update the affected plugin. From the WordPress installation directory, an administrator who maintains plugins with WP-CLI can review pending updates with:
wp plugin list --update=available --format=table
After a tested backup, wp plugin update --all updates all plugins with available releases. Only use that broader command when it fits your normal change process, because it can update plugins unrelated to this advisory. Re-run wp plugin list --format=table afterwards and verify Modern Events Calendar is at 7.37.0 or later.
Also remove accounts that are no longer needed and require unique passwords for accounts that remain. Review your regular update routine against this WordPress hardening checklist, including plugins on sites that receive little day-to-day attention. If you need a structured review of plugins, accounts, and WordPress configuration, a security audit can provide a documented baseline.
When to get help
Get help if you find an unknown user, cannot establish which edition or version is installed, or need to assess possible database exposure. Our WordPress hardening service can help close avoidable gaps, while WordPress malware removal is available when there are signs the site has been altered.