SQL Injection Vulnerability in Modern Events Calendar Lite Plugin for WordPress

CVE-2021-4458

What is CVE-2021-4458?

The Modern Events Calendar Lite plugin for WordPress contains a SQL Injection vulnerability that can be exploited through the 'id' parameter within the 'wp_ajax_mec_load_single_page' AJAX action. This issue arises due to inadequate escaping of user-supplied input and a lack of preparation within the SQL query itself. Attackers, particularly those who can disable addslashes on the server, could potentially manipulate existing queries, allowing them to extract sensitive information from the database.

References