CVE-2026-110069
UnknownSummary
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data. This allows any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.
Risk Assessment
Leakage of personal and financial data of attendees can breach privacy, lead to fraud, and result in GDPR non-compliance penalties. It may also damage the organization's reputation.
Recommendation
Update the Modern Events Calendar Lite plugin to version 7.37.0 or later. Assess whether a data breach occurred and take appropriate steps in accordance with data protection regulations.
Other vulnerabilities in Modern Events Calendar Lite
See all- CVE-2026-110070Unknown
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it. This allows authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.
- CVE-2026-105067High
An SQL Injection vulnerability in Webnus Modern Events Calendar Lite allows blind SQL injection. Affects versions before 7.37.0.
Original NVD description (English source)
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS