The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users. This vulnerability requires verification of user roles and access controls, monitoring for [truncated]
ReviewModern Events Calendar LiteCVE published 2026-10-18
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data. This allows any authenticated user, including Subscribers, to disclose sensitive information such as names, email addresses, transaction IDs, and payment amounts of every booking on the site. Defenders should assess exposure and prioritize [truncated]
