Live › vulnerability › CVE-2026-110069
Go to dashboardThe Modern Events Calendar Lite WordPress plugin before 7.37.0 returns event booking data without capability, nonce or ownership checks. Any logged-in user, including a Subscriber, can read names, email addresses, transaction IDs and payment amounts for every booking on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Modern Events Calendar Lite before 7.37.0 that let people hold any logged-in account, such as subscriber accounts from open registration or customer accounts from a shop plugin. Sites with no logged-in users beyond administrators are much less exposed. Sites on the current release can skip it.
No product ranges from the sources yet.
wp plugin get modern-events-calendar-lite --field=version7.37.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.
This page as .md · .json · in your agent: get_signal("CVE-2026-110069")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.