Security Bulletin — July 20, 2026: Three Unauthenticated WordPress Plugin Flaws — SQL Injection, Path Traversal, and Stored XSS (CVE-2026-11349, CVE-2026-12898 & CVE-2026-10081)

This is our daily security overview, in which we review the published vulnerabilities and highlight those that are actually relevant for the operation of WordPress websites, online shops, and PHP applications. Every statement has been verified against the underlying primary source and linked at the end of the respective section. July 20 brings three WordPress plugin flaws that share one property: all of them can be triggered without any login. Two sit in widely used extensions, and one sits in a plugin that runs on several million installations. A corrected release already exists for all three, so the only reliable measure is to install it promptly.

SQL Injection in Modern Events Calendar — Reaching the Database Without a Login (CVE-2026-11349)

The calendar plugin Modern Events Calendar — in its free Lite edition (around 100,000 active installations) as well as the paid Pro edition — contains, up to and including version 7.33, a SQL injection that requires no login. The cause is a parameter of the publicly reachable AJAX action mec_list_load_more, which is passed straight into a database query without sanitization or escaping. Because the associated endpoint is open to anonymous visitors, an attacker can inject their own SQL statements through that parameter and thereby read arbitrary contents of the WordPress database — from the user table to the password hashes of administrators, which can be cracked offline, all the way to the installation’s secret keys. With a severity of CVSS 8.6 and the combination of no login requirement and broad distribution, this is one of the more serious flaws of the week. The developers fixed the issue in version 7.34.0; operators running an older release should apply the update without delay.

Sources: NVD — CVE-2026-11349 · WordPress.org — Modern Events Calendar Lite

Path Traversal in All-in-One WP Migration — Millions of Installations Exposed (CVE-2026-12898)

Few WordPress tools are as widespread as All-in-One WP Migration and Backup by ServMask, which is installed on more than five million websites. In versions 7.87 through 7.105, the plugin builds the path of its error-log file from a caller-influenced value without reliably stripping directory-traversal sequences. Because that manipulable value then serves as the target of the write operation, an unauthenticated request can steer the write out of the intended directory and create a file — or append to an existing one — at any location the web server can write to. The CVSS vector reports no loss of confidentiality, but it does report an impact on integrity and availability (CVSS 6.5): the issue is therefore not about reading data, but about the unauthorized modification of files. Given the plugin’s enormous reach, however, the attack surface is exceptionally large. The corrected version 7.106 closes the flaw; anyone running one of the affected releases should update quickly.

Sources: NVD — CVE-2026-12898 · WordPress.org — All-in-One WP Migration

Stored XSS in Unlimited Elements via a Poisoned Google Review (CVE-2026-10081)

The most unusual case of the day affects Unlimited Elements For Elementor (around 200,000 active installations) in all versions before 2.0.11. The plugin pulls Google reviews through an external interface and displays their text in the “Google Reviews” widget — but without escaping or sanitizing the content. The text of a review, however, is a field the attacker controls: they need only leave a crafted review on the affected business’s Google listing. If that review contains script markup, it is carried unchanged into the page and executed in the browser of every visitor who opens a page with the widget — administrators included. This allows the session context to be hijacked, malicious code to be loaded, or the page to be defaced. At CVSS 8.8 this is a high severity; what makes it especially notable is the attack path, which runs through a third-party platform rather than the WordPress site itself. The developers fixed the issue in version 2.0.11.

Sources: NVD — CVE-2026-10081 · WordPress.org — Unlimited Elements For Elementor

Unsure whether you are affected? Get in touch.

---

This notice serves security-awareness purposes. The official advisories of the respective vendor and the primary sources linked above are always authoritative.