---
id: "CVE-2026-110069"
kind: "vulnerability"
aliases: ["CVE-2026-110069"]
title: "Modern Events Calendar Lite WordPress plugin leaks booking and attendee data to subscribers"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-open-registration", "version-7.37.0-or-later"]
published_at: "2026-10-18T07:16:52+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:39:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110069", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Modern Events Calendar Lite WordPress plugin leaks booking and attendee data to subscribers

The Modern Events Calendar Lite WordPress plugin before 7.37.0 returns event booking data without capability, nonce or ownership checks. Any logged-in user, including a Subscriber, can read names, email addresses, transaction IDs and payment amounts for every booking on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Modern Events Calendar Lite in the WordPress admin plugins list or with `wp plugin get modern-events-calendar-lite --field=version`
- Confirm whether open subscriber registration is enabled under Settings > General > Membership

## Fix

- Update Modern Events Calendar Lite to `7.37.0` or later
- Until updated, disable open registration for new users so only trusted accounts can log in

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110069

## From the sources

The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_