Modern Events Calendar - SQLi (CVE-2021-24946)

CVE-2021-24946 is a critical vulnerability in the Modern Events Calendar Lite WordPress plugin that enables unauthenticated attackers to perform SQL injection by exploiting improper handling of a parameter in a specific AJAX action.

CrowdSec has been tracking this vulnerability and its exploits since 10th of March 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2021-24946 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. In addition, according to the CrowdSec network, attack volume against CVE-2021-24946 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed exploitation attempts are characterized by requests made to URLs containing /wp-admin/admin-ajax.php?action=mec_load_single_page&time=, where attackers attempt direct SQL injection through the vulnerable parameter.