External risk intelligence

Modern Events Calendar Unauthenticated SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-73339

This vulnerability affects a WordPress calendar plugin designed to be displayed on public-facing websites. As a web-based plugin intended for public event listing, its functionality is inherently exposed to the internet and reachable by any remote user without authentication.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Modern Events Calendar, a widely used WordPress plugin. This issue allows unauthenticated attackers to potentially access or manipulate sensitive data stored in the database, which could have significant implications for the integrity and availability of your organization's information. The primary concern at this time is to confirm whether your organization utilizes this specific calendar plugin and, if so, to determine the extent of any potential exposure.

Unauthenticated database access flaw.
Matters for data integrity and availability.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target unauthenticated users by sending specially crafted requests to the Modern Events Calendar plugin. This can lead to unauthorized access to sensitive data, potentially impacting the integrity and availability of the system.

No authentication required.
Triggers via malicious input.
Data exposure and manipulation.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated SQL injection in the Modern Events Calendar plugin could allow an attacker to access or modify event data. This could occur when the plugin is used to display event information, potentially leading to disruptions in service or data integrity issues.

Event data and database integrity.
Through unauthenticated network requests.
Compromise of event information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection in Modern Events Calendar impacts applications with internet-facing websites where event details are displayed. The first practical step involves identifying all instances of the affected plugin, confirming its accessibility from the internet, assessing business criticality, and then engaging the accountable owner for remediation planning.

Application owners should manage this issue.
Verify internet reachability and business impact.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Modern Events Calendar?

Modern Events Calendar is a WordPress plugin used to manage, schedule, and display event listings on websites. It acts as a bridge between a database and a site visitor, enabling organizations to publish event dates, locations, and descriptions in a user-friendly interface.

What does SQL injection mean for CVE-2026-73339?

This vulnerability falls under the CWE-89 weakness class, which refers to improper neutralization of special elements in SQL commands. Essentially, the plugin fails to properly filter user input before using it to query the database, allowing an attacker to insert malicious database commands to read or manipulate stored event information.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by sending a specially crafted network request to the plugin that contains malicious database code. Notably, this does not require a user to log in or hold an administrative account; the software processes the harmful input automatically. Normal, non-malicious browsing behavior does not trigger this issue.

Why should I care about this CVE if my site is internal?

Halo Surface Signal indicates that this plugin is typically used for public-facing event listings, making it inherently reachable over the internet. While internal sites are less exposed to anonymous remote attackers, any instance of the plugin accessible via a network remains a potential target if not properly secured.

What should I do first to address this risk?

Your first step is to perform an inventory of all WordPress sites to identify if and where this plugin is installed. Once you have a list of active instances, confirm which are internet-facing and prioritize them for remediation by contacting the site owners to plan for the necessary updates.

References

patchstack.com/database/wordpress/plugin/modern-events-calendar/vuln…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.