Live › vulnerability › CVE-2026-110070
Go to dashboardThe Modern Events Calendar Lite WordPress plugin before 7.36.4 does not check that a user may edit a post before updating it. An authenticated user with the Subscriber role can change the title, content and excerpt of posts, pages and custom post types written by other users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Modern Events Calendar Lite plugin before 7.36.4 that let people register accounts with the Subscriber role are exposed, because any logged-in subscriber can alter content owned by others. Sites with registration closed and no untrusted accounts are much less exposed, and sites not running this plugin can skip it.
No product ranges from the sources yet.
wp plugin get modern-events-calendar-lite --field=version with WP-CLI.7.36.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.
This page as .md · .json · in your agent: get_signal("CVE-2026-110070")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.