---
id: "CVE-2026-110070"
kind: "vulnerability"
aliases: ["CVE-2026-110070"]
title: "WordPress Modern Events Calendar Lite: subscribers can edit other users' posts"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["event-calendars", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "registration-closed", "version-7.36.4-or-later"]
published_at: "2026-10-18T07:16:52+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:57:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110070", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# WordPress Modern Events Calendar Lite: subscribers can edit other users' posts

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not check that a user may edit a post before updating it. An authenticated user with the Subscriber role can change the title, content and excerpt of posts, pages and custom post types written by other users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or run `wp plugin get modern-events-calendar-lite --field=version` with WP-CLI.
- Confirm whether subscribers can register on the site under Settings > General > Membership.

## Fix

- Update Modern Events Calendar Lite to `7.36.4` or later.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110070

## From the sources

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_