Description

Modern Events Calendar Lite registers a family of unauthenticated admin-ajax.php "load more" actions for its event-list skins (list, grid, masonry, agenda, timeline, tile, custom). Each handler reads the attacker-controlled atts request array, passes it through a helper named sanitize_deep_array() that — when called with its default arguments — performs no sanitization at all — and then concatenates the atts['include'] (and atts['exclude']) values raw into a post_id IN (...) SQL fragment that is executed with $wpdb->get_results() and no $wpdb->prepare().

Because the entry points are registered on wp_ajax_nopriv_*, no authentication, account, nonce, or user interaction is required. An unauthenticated remote attacker can inject arbitrary SQL into the WHERE clause of a SELECT against wp_mec_dates and read any data in the WordPress database (user password hashes, wp_options secrets/keys, other plugins' data) via blind time-based / boolean / error-based techniques.

Root cause

1. A "sanitizer" that sanitizes nothing on the default path

app/libraries/main.php:9607:

The guard (is_array($excludes) and !count($excludes)) makes the function a complete no-op when $excludes is the default empty array — every value is copied through verbatim. The intent was evidently "if there is an exclude-list, skip those keys"; the boolean logic instead skips everything whenever no exclude-list is supplied.

2. The caller supplies no $excludes

app/skins/list.php:499-501 (load_more()):

sanitize_deep_array($_REQUEST['atts']) is called with a single argument → $excludes defaults to array() → the no-op branch above → $atts is the raw, untrusted $_REQUEST['atts'].

3. Raw concatenation into the IN (...) clause

app/libraries/skins.php:

The array elements are implode()d directly into the SQL string with no integer cast and no escaping. (absint()/(int) on each element would have closed this.)

4. Execution with no prepared statement

app/libraries/db.php:79:

The fully-built string is handed to $wpdb->get_results() verbatim.

Taint flow (request → sink):

Reachability

app/skins/list.php:51-52:

The nopriv registration makes the endpoint reachable pre-authentication. The same load_more() shape and the shared skins.php query builder are present in the sibling skins, each with its own wp_ajax_nopriv_* action, so the same injection is reachable through any of:

No nonce is checked in load_more(), and the action does not require any plugin shortcode to be present on a page — the AJAX handlers are registered unconditionally at init.

Proof of Concept (lab-verified, MEC Lite 6.5.6, WordPress 6.6.5, MariaDB 10.x)

All requests are unauthenticated (no cookie, no nonce). The injected value is placed in atts[include][]; the payload closes the two open parentheses of the IN ((...) AND (... IN ( group and appends a top-level OR <sleep> so the condition is evaluated for every scanned row, then comments out the trailing )) ORDER BY ...:

The exact query executed (captured from WP_DEBUG_LOG) for an error-canary atts[include][]=0)MEC_SQLI_CANARY was:

— the literal token MEC_SQLI_CANARY appears verbatim in the executed statement, confirming raw concatenation. The atts[exclude][] parameter (skins.php:803 / 603, NOT IN) is injectable identically (lab-confirmed: atts[exclude][]=0)) OR SLEEP(3)# → ~3.5s). The identical query and injection were reproduced on 7.33.0 (current build) — same canary, same SLEEP behaviour.

Automated PoC

mec-unauth-sqli-poc.py (included) is fully self-contained and requires no credentials: it confirms the injection (baseline vs. SLEEP), then performs time-based blind extraction of arbitrary data (default: @@version, DB user, and the first admin's user_login:user_pass). It validates each response (HTTP 200) and paces requests with --delay + back-off to survive WAF/rate-limiting (e.g. mod_evasive). No data is modified (read-only SELECT context).

Impact

Unauthenticated, network-reachable, full read access to the database: wp_users password hashes, wp_options (auth_key, API secrets, tokens), and any other table. In practice this chains to full site takeover (offline hash cracking, secret/session theft). Integrity impact is limited — the injection executes in a SELECT via $wpdb->get_results(), which does not permit stacked queries — hence I:N. Heavy SLEEP/BENCHMARK could degrade availability, but the primary, reliably-demonstrated impact is confidentiality (C:H), giving CVSS 7.5.

Affected files

Line numbers are given for 7.33.0 (current) with 6.5.6 in parentheses; the code is identical across the range.

The sibling skins (grid, masonry, agenda, timeline, tile, custom) share the same load_more() + skins.php query builder and each register a wp_ajax_nopriv_* action → same bug, multiple entry points.

Distinction from prior Modern Events Calendar SQL injection CVEs

This is a distinct, previously unreported injection point. Every publicly documented MEC SQL injection targets a different AJAX action and parameter, and all were patched in versions this finding post-dates (it is lab-confirmed live in 7.33.0):

• Different code path. The prior unauthenticated issues are in the single-event handler mec_load_single_page; this one is in the skin "load more" pagination (load_more() → MEC_skin::initialize() → app/libraries/skins.php post_id IN (...) builder), reached through the no-op default branch of sanitize_deep_array(). The mec_load_single_page patches do not touch skins.php.
• No configuration precondition. CVE-2021-4458 (id) was exploitable only with PHP/WordPress input slashing disabled (a non-default state) because that value sits in a quoted context. Here the atts[include]/atts[exclude] values land in an unquoted numeric IN(...) context and are exploited with parentheses + SQL keywords (0)) OR SLEEP(3)#), which wp_magic_quotes() does not neutralise. It is therefore exploitable on a default WordPress install — lab-confirmed on stock WP 7.0 (magic quotes on).
• Survives every prior fix. Confirmed firing on 7.33.0 — four years and a major version after the last mec_load_single_page patch (6.4.0).

Disclosure / scope note

Modern Events Calendar Lite was delisted from wordpress.org on 2022-05-11 ("Reason: Guideline Violation"), so the wordpress.org build is frozen at 6.5.6. This does not mean the plugin is abandoned — Webnus continued development off-platform: the current Lite build distributed from mec.webnus.net is 7.33.0, and the vulnerable code path is byte-for-byte the same there (lab-confirmed; the SQLi fires identically on 7.33.0). The bug therefore affects every release across the post-delisting range, not just the frozen wordpress.org copy.

Routing implications (the "closed on wordpress.org" objection is much weaker than it first appears):

• It is a current, vendor-distributed, supported product, not abandoned code — a coordinated disclosure to Webnus is the primary channel; they actively ship updates and should patch.
• MEC Pro (actively sold; current 7.x) is built on this same 7.x codebase. app/libraries/skins.php, app/libraries/main.php, and app/libraries/db.php are shared core libraries, so Pro is near-certainly affected. This should be confirmed against Pro source before formally asserting it, but the shared-library architecture makes it very likely. A confirmed Pro impact makes the finding unambiguously in-scope for Patchstack (a publicly-sold component) and worth a MITRE/Patchstack CVE regardless of the wordpress.org listing status.
• For consumers that gate on the wordpress.org listing specifically (some Wordfence bounty criteria; Patchstack's "closed component" exclusion as applied to the Lite free build), cite the vendor-distributed 7.33.0 + Pro impact rather than the frozen 6.5.6.

A CVE is warranted on the merits: unauthenticated, network-reachable, full-DB-read SQL injection in a current, vendor-distributed product with a six-figure historical install base.

Timeline