CVE-2026-110070 Modern Events Calendar Lite CVE debrief

Who should care

WordPress administrators, security teams, and users with the Subscriber role should assess exposure and prioritize remediation for installations using the Modern Events Calendar Lite plugin, especially those with untrusted or unauthenticated users.

Why it matters

CVE-2026-110070 allows authenticated users with the Subscriber role to modify arbitrary posts, pages, and custom post types created by other users in WordPress installations using the Modern Events Calendar Lite plugin before version 7.36.4. This vulnerability requires verification of user roles and access controls, monitoring for suspicious activity, and prioritization of remediation for installations with untrusted or unauthenticated users.

• Potential unauthorized modification of posts, pages, and custom post types
• Possible data tampering or injection of malicious content
• Required verification of user roles and access controls for the plugin
• Necessity to monitor for suspicious activity on affected installations

Technical summary

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users. This vulnerability requires verification of user roles and access controls, and monitoring for suspicious activity to prevent potential unauthorized modification of posts, pages, and custom post types, and possible data tampering or injection of malicious content.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the Modern Events Calendar Lite plugin, especially those with untrusted or unauthenticated users.

Recommended defensive actions

• Assess exposure by checking WordPress installations for the Modern Events Calendar Lite plugin version before 7.36.4
• Prioritize remediation for installations with untrusted or unauthenticated users
• Verify user roles and access controls for the plugin
• Monitor for suspicious activity on affected installations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions, exploitation, and remediation. The source details are limited, and defenders should verify the vulnerability scope and impact through additional sources. The CVE Program and NVD entries provide some context, but more information is needed to fully understand the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.