CyberRota Analysis
AI-GeneratedThe Modern Event Calendar Pro and Lite WordPress plugins prior to version 7.34.0 are vulnerable to an unauthenticated SQL injection due to inadequate sanitization and escaping of request parameters in an AJAX action. This vulnerability allows attackers to execute arbitrary SQL queries, potentially leading to the extraction of sensitive database information. WordPress site administrators using these plugins should prioritize immediate updates to mitigate the risk of data breaches.
Original NVD Description
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.