Modern Events Calendar - SQLi (CVE-2021-24946)

CVE-2021-24946 is a critical vulnerability in the Modern Events Calendar Lite WordPress plugin that enables unauthenticated attackers to perform SQL injection by exploiting improper handling of a parameter in a specific AJAX action.

CrowdSec has been tracking this vulnerability and its exploits since 10th of March 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2021-24946 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2021-24946 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2021-24946 is currently experiencing high visibility and active exploitation across the internet.

Observed exploitation attempts are characterized by requests made to URLs containing /wp-admin/admin-ajax.php?action=mec_load_single_page&time=, where attackers attempt direct SQL injection through the vulnerable parameter.