{"id":"CVE-2026-110070","kind":"vulnerability","aliases":["CVE-2026-110070"],"related":[],"title":"WordPress Modern Events Calendar Lite: subscribers can edit other users' posts","description":"The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.","summary":"The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not check that a user may edit a post before updating it. An authenticated user with the Subscriber role can change the title, content and excerpt of posts, pages and custom post types written by other users.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-calendars","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","registration-closed","version-7.36.4-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or run `wp plugin get modern-events-calendar-lite --field=version` with WP-CLI.\n- Confirm whether subscribers can register on the site under Settings > General > Membership.","fix":"- Update Modern Events Calendar Lite to `7.36.4` or later.","status":"open","published_at":"2026-10-18T07:16:52+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:57:36+00:00","updated_at":"2026-10-25T03:57:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:57:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update Modern Events Calendar Lite to `7.36.4` or later.","reach":"internet","title":"WordPress Modern Events Calendar Lite: subscribers can edit other users' posts","impact":"medium","summary":"The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not check that a user may edit a post before updating it. An authenticated user with the Subscriber role can change the title, content and excerpt of posts, pages and custom post types written by other users.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","event-calendars"],"confidence":0.7,"needs_auth":"yes","worst_case":"Subscribers can overwrite titles and content of other users' posts","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or run `wp plugin get modern-events-calendar-lite --field=version` with WP-CLI.\n- Confirm whether subscribers can register on the site under Settings > General > Membership.","needs_analyst":false,"not_affected_if":["plugin-not-installed","registration-closed","version-7.36.4-or-later"],"who_is_affected":"Sites running the Modern Events Calendar Lite plugin before 7.36.4 that let people register accounts with the Subscriber role are exposed, because any logged-in subscriber can alter content owned by others. Sites with registration closed and no untrusted accounts are much less exposed, and sites not running this plugin can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000608,"input_tokens":3325,"output_tokens":552,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110070':14A,17A '-2026':13A,16A '7.36.4':34B,81C 'allow':98C 'arbitrari':113C 'authent':49B,99C 'author':89C 'calendar':4A,20B,29B,76C 'chang':56B 'check':37B 'content':59B,109C 'creat':120C 'custom':66B,117C 'cve':12A,15A 'edit':8A,42B,91C 'event':3A,19B,28B,75C 'event-calendar':18B 'excerpt':61B,111C 'host':24B 'lite':5A,30B,77C 'may':41B 'modern':2A,27B,74C 'modifi':106C 'packag':21B 'page':64B,115C 'plugin':32B,79C 'post':11A,44B,63B,67B,94C,114C,118C 'role':54B,104C 'self':23B 'self-host':22B 'subscrib':6A,53B,103C 'target':93C 'titl':58B,108C 'type':68B,119C 'updat':46B,96C 'user':10A,40B,50B,72B,87C,100C,123C 'verifi':84C 'wordpress':1A,25B,31B,78C 'written':69B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Modern Events Calendar Lite plugin before 7.36.4 that let people register accounts with the Subscriber role are exposed, because any logged-in subscriber can alter content owned by others. Sites with registration closed and no untrusted accounts are much less exposed, and sites not running this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110070","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110070","severity":null,"published_at":"2026-10-18T07:16:52+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}