Skip to content
Sign in
6.5 Medium

CVE-2026-110070 The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the…

Description

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.

Affected products and versions

Product Affected versions Fixed in
Modern Events Calendar Lite 7.36 earliest → < 7.36.4 7.36.4

Other CVEs of Modern Events Calendar Lite

The 16 CVEs of Modern Events Calendar Lite →
CVE-2026-102499 The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0… 7.7 High CVE-2026-96534 The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0… 7.7 High CVE-2026-110069 The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks… 4.3 Medium CVE-2026-11349 The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0… 8.6 High
Track this CVE