6.5
Moyenne
CVE-2026-110070 The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the…
Description
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Modern Events Calendar Lite 7.36 | premières → < 7.36.4 | 7.36.4 |
Autres CVE de Modern Events Calendar Lite
Les 16 CVE de Modern Events Calendar Lite →
CVE-2026-102499
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0…
7.7
Élevée
CVE-2026-96534
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0…
7.7
Élevée
CVE-2026-110069
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks…
4.3
Moyenne
CVE-2026-11349
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0…
8.6
Élevée