CVE-2026-105067: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Webnus Modern Events Calendar Lite

The vulnerability identified as CVE-2026-105067 involves improper neutralization of special elements used in SQL commands within the Webnus Modern Events Calendar Lite plugin. This flaw enables blind SQL injection attacks, which can be exploited remotely with low attack complexity and privileges. The vulnerability affects versions from initial releases up to but not including 7.37.0. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact reported.

An attacker with low privileges can exploit this vulnerability remotely to perform blind SQL injection attacks, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited availability issues. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Webnus advisories for an official fix and apply updates promptly once available. Until then, consider restricting access to the affected plugin and minimizing privileges where possible.