{"id":"CVE-2026-110069","kind":"vulnerability","aliases":["CVE-2026-110069"],"related":[],"title":"Modern Events Calendar Lite WordPress plugin leaks booking and attendee data to subscribers","description":"The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.","summary":"The Modern Events Calendar Lite WordPress plugin before 7.37.0 returns event booking data without capability, nonce or ownership checks. Any logged-in user, including a Subscriber, can read names, email addresses, transaction IDs and payment amounts for every booking on the site.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-open-registration","version-7.37.0-or-later"],"how_to_check":"- Check the installed version of Modern Events Calendar Lite in the WordPress admin plugins list or with `wp plugin get modern-events-calendar-lite --field=version`\n- Confirm whether open subscriber registration is enabled under Settings > General > Membership","fix":"- Update Modern Events Calendar Lite to `7.37.0` or later\n- Until updated, disable open registration for new users so only trusted accounts can log in","status":"open","published_at":"2026-10-18T07:16:52+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:39:48+00:00","updated_at":"2026-10-25T04:39:48+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:39:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update Modern Events Calendar Lite to `7.37.0` or later\n- Until updated, disable open registration for new users so only trusted accounts can log in","reach":"internet","title":"Modern Events Calendar Lite WordPress plugin leaks booking and attendee data to subscribers","impact":"medium","summary":"The Modern Events Calendar Lite WordPress plugin before 7.37.0 returns event booking data without capability, nonce or ownership checks. Any logged-in user, including a Subscriber, can read names, email addresses, transaction IDs and payment amounts for every booking on the site.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Any logged-in user can read all booking names, emails and payment amounts","analyst_note":"","how_to_check":"- Check the installed version of Modern Events Calendar Lite in the WordPress admin plugins list or with `wp plugin get modern-events-calendar-lite --field=version`\n- Confirm whether open subscriber registration is enabled under Settings > General > Membership","needs_analyst":false,"not_affected_if":["version-7.37.0-or-later","no-open-registration"],"who_is_affected":"Sites running Modern Events Calendar Lite before 7.37.0 that let people hold any logged-in account, such as subscriber accounts from open registration or customer accounts from a shop plugin. Sites with no logged-in users beyond administrators are much less exposed. Sites on the current release can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3330,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110069':16A,19A '-2026':15A,18A '7.37.0':36B,79C 'address':59B,106C 'allow':95C 'amount':64B,111C 'attende':10A,93C 'authent':97C 'book':8A,39B,67B,91C,114C 'calendar':3A,31B,74C 'capabl':42B,83C 'check':46B,87C 'cve':14A,17A 'data':11A,40B,94C 'disclos':102C 'email':58B,105C 'event':2A,30B,38B,73C,90C 'everi':66B,113C 'host':23B 'id':61B,108C 'includ':52B,99C 'leak':7A 'lite':4A,32B,75C 'log':49B 'logged-in':48B 'modern':1A,29B,72C 'name':57B,104C 'nonc':43B,84C 'ownership':45B,86C 'packag':20B 'payment':63B,110C 'perform':82C 'plugin':6A,27B,34B,77C 'read':56B 'return':37B,89C 'self':22B 'self-host':21B 'site':70B,117C 'subscrib':13A,54B,100C 'transact':60B,107C 'user':51B,98C 'without':41B 'wordpress':5A,24B,26B,33B,76C 'wordpress-plugin':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running Modern Events Calendar Lite before 7.37.0 that let people hold any logged-in account, such as subscriber accounts from open registration or customer accounts from a shop plugin. Sites with no logged-in users beyond administrators are much less exposed. Sites on the current release can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110069","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110069","severity":null,"published_at":"2026-10-18T07:16:52+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}