Key points
- CVE-2026-109901 carries a CVSS score of 8.5, rated as high severity.
- The vulnerability exists in Codepeople CP Multi View Event Calendar versions up to 1.4.41.
- The NVD record does not state whether a fix or update is available.
Security teams must address a high-severity SQL injection vulnerability identified as CVE-2026-109901 in the Codepeople CP Multi View Event Calendar plugin. The flaw affects all versions of the software from its initial release through version 1.4.41. The National Vulnerability Database assigns the issue a CVSS score of 8.5, classifying it as high severity. This rating reflects the potential for significant compromise if the weakness is exploited by an attacker.
In plain English
SQL injection occurs when an application fails to properly neutralize special characters entered by users. Attackers can insert malicious SQL commands into input fields, which the database then executes. In this case, the CP Multi View Event Calendar plugin does not adequately sanitize inputs. This allows an attacker to manipulate the database queries directly. Such manipulation can lead to unauthorized data access, modification, or deletion. The weakness is categorized under CWE-89 for improper neutralization.
The background
The vulnerability was documented in the National Vulnerability Database record for CVE-2026-109901. The record specifies that the improper neutralization of special elements used in SQL commands is the root cause. It explicitly lists the affected product as Codepeople CP Multi View Event Calendar. The range of affected versions is defined as from not applicable through 1.4.41. No other software products are mentioned in this specific advisory record.
What changes now
Teams managing WordPress installations must verify if they use the CP Multi View Event Calendar plugin. If the installed version is 1.4.41 or lower, the system is vulnerable. The NVD record does not confirm the availability of a patch. Administrators must assess the risk of keeping the plugin active. Some teams may choose to disable the plugin temporarily. Others might restrict access to the affected endpoints until further information is released.
Who needs to act first
Teams should prioritize systems that expose the plugin to untrusted users or public-facing forms. Check whether the calendar feature accepts direct user input without strict validation. Roll out any mitigation changes in a staging environment first to ensure site stability. Back up database configurations before making changes. If no fix exists, consider disabling the plugin on non-critical sites to reduce the attack surface. Monitor logs for unusual database queries.
What to do and how to stay safe: Codepeople
- Audit all WordPress installations to identify if CP Multi View Event Calendar is installed.
- Verify the current version number against the affected range of up to 1.4.41.
- Restrict access to pages using the plugin if it cannot be disabled immediately.
- Monitor database logs for unexpected SQL commands or unusual query patterns.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The CVE ID is CVE-2026-109901.
Which versions of the plugin are affected?
Versions from the initial release through 1.4.41 are affected.
Is there a patch available for this flaw?
The NVD record does not state whether a fix is available.
