CVE-2026-110070
Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.
| Vendor | unknown |
| Product | modern events calendar lite |
| Published | Oct 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown modern events calendar lite
Be the first to know when new unknown vulnerabilities affecting unknown modern events calendar lite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Modern Events Calendar Lite
0 < 7.36.4
References
Credits
Nguyen Duc Thinh WPScan