CVE-2021-24149: Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-18 · updated 2026-06-17
Weakness: CWE-89

Description

Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_form AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue.

Affected products

Modern Events Calendar Lite: before 5.16.6 — fixed in 5.16.6

How to fix

Upgrade to a fixed version: Modern Events Calendar Lite 5.16.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/26819680-22a8-4348-b63d-dc52c0d50ed0
https://wpscan.com/vulnerability/26819680-22a8-4348-b63d-dc52c0d50ed0

Get alerted when CVE-2021-24149 or the next vulnerability affects your stack