CVE-2026-110070
UnknownSummary
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it. This allows authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.
Risk Assessment
A low-privileged user can modify content belonging to others, violating data integrity and potentially leading to disinformation or sabotage. This may undermine trust in the site.
Recommendation
Update the Modern Events Calendar Lite plugin to version 7.36.4 or later. Check whether content was unauthorizedly modified.
Other vulnerabilities in Modern Events Calendar Lite
See all- CVE-2026-110069Unknown
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data. This allows any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.
- CVE-2026-105067High
An SQL Injection vulnerability in Webnus Modern Events Calendar Lite allows blind SQL injection. Affects versions before 7.37.0.
Original NVD description (English source)
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS