CVE-2021-24946

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue

El plugin Modern Events Calendar Lite de WordPress versiones anteriores a 6.1.5, no sanea ni escapa del parámetro time antes de usarlo en una sentencia SQL en la acción mec_load_single_page AJAX, disponible para usuarios no autenticados, conllevando un problema de inyección SQL no autenticada