CVE-2021-4458
Published: 12 July 2025
Summary
CVE-2021-4458 is a medium-severity SQL Injection (CWE-89) vulnerability in Webnus Modern Events Calendar Lite. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-4458 is a SQL injection vulnerability in the Modern Events Calendar Lite plugin for WordPress, affecting all versions up to and including 6.3.0. The flaw occurs via the 'id' parameter in the 'wp_ajax_mec_load_single_page' AJAX action, stemming from insufficient escaping of the user-supplied parameter and lack of sufficient preparation in the existing SQL query. It has a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-89.
Unauthenticated attackers can exploit this vulnerability over the network to append additional SQL queries to existing ones, enabling extraction of sensitive information from the database. Exploitation requires high attack complexity and is limited to sites where addslashes is disabled, with no privileges, user interaction, integrity impact, or availability disruption needed.
Mitigation details are available in referenced advisories, including Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/703ba736-5834-40f2-9cf6-a6a70a73e4d6?source=cve and a patch applied in WordPress plugin trac changeset 2683727 at https://plugins.trac.wordpress.org/changeset/2683727/modern-events-calendar-lite/trunk/app/libraries/render.php in the render.php file.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-34683
Vulnerability details
The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_page' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and…
more
lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on sites with addslashes disabled.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin enables remote unauthenticated exploitation (T1190) and direct database data extraction (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted inputs such as the 'id' parameter before they reach SQL queries, eliminating the root cause of the injection.
Mandates timely application of the vendor patch (changeset 2683727) that adds proper escaping and prepared-statement handling to the affected AJAX action.
Enables monitoring and alerting on anomalous database query patterns or error responses that would indicate attempted exploitation of the unauthenticated SQLi vector.