CVE-2026-110069
Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.
| Vendor | unknown |
| Product | modern events calendar lite |
| Published | Oct 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown modern events calendar lite
Be the first to know when new unknown vulnerabilities affecting unknown modern events calendar lite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Modern Events Calendar Lite
0 < 7.37.0
References
Credits
Usama Arshad WPScan