CVE-2021-4458 is a medium severity (CVSS 5.9) SQL injection in the Modern Events Calendar Lite WordPress plugin up to and including 6.3.0. The id parameter of the mec_load_single_page AJAX action is not escaped properly, but the record says it is only exploitable when addslashes is disabled. Update the plugin.
What's affected
The Modern Events Calendar Lite plugin for WordPress, all versions up to and including 6.3.0, per the record. The record names the wp_ajax_mec_load_single_page AJAX action and its id parameter, and says the cause is insufficient escaping together with an unprepared query.
The record adds an important condition: the flaw is only exploitable on sites with addslashes disabled. That narrows the exposure, since many WordPress setups apply slashing to request data. It does not make the plugin safe to leave as it is.
The record does not give the fixed version number. The referenced code change is in the plugin's public repository, so check the plugin's changelog for the first release after 6.3.0 and update to the current version. WordPress hosting setups differ in how request data is slashed, which is why the record's precondition cannot be judged from the plugin alone.
How to check if you're exposed
List the installed version with WP-CLI:
wp plugin list --name=modern-events-calendar-lite --fields=name,status,version
If you do not use WP-CLI, open the Plugins page in the WordPress admin and read the version under the plugin name. Anything at 6.3.0 or lower is in scope.
For a fleet of sites, loop over them with the same command or use your management tooling. Also check for the plugin on staging copies and old sites that nobody visits.
Then see whether your environment is in the condition the record describes. If you are not sure, assume yes and update.
What to do now
- Find every WordPress site that has Modern Events Calendar Lite installed.
- Update the plugin to the latest version. Check its changelog for the release after 6.3.0.
- If you cannot update, deactivate the plugin until you can.
- Review database and web logs for unusual requests to the AJAX action.
- Keep WordPress, plugins and themes on a regular update schedule, including sites that are rarely edited.
Why it matters
The class is CWE-89 (SQL Injection). The plugin builds a query using the id value from the request without enough escaping or a prepared statement. The record notes that an unauthenticated attacker could append extra queries to extract sensitive information from the database.
This record is a good lesson in reading severity. The score is medium because of the precondition. The condition may not apply to your site, but you rarely know every setting that your hosting provider or other plugins change. Updating costs little. Reasoning about edge cases costs more.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Try it yourself
Plugin issues keep arriving after you ship. This demo shows how continuous monitoring flags a newly disclosed CVE in something you already run.
Click through it at your own pace, or open it full screen.
Quick check
Is every site with this plugin exploitable?
No. The record says it is only exploitable on sites with addslashes disabled. You should still update.
Which version fixes it?
The record does not state it. Update to the latest release and read the plugin changelog for the first version after 6.3.0.
Sources
Last reviewed: 19 October 2026.
