CVE-2026-110070
Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR
Unknown Modern Events Calendar Lite
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 7.36.4Modern Events Calendar LiteCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.
Text from CVE List
Affected versions 1
- Modern Events Calendar Liteaffected: all versions before 7.36.4CVE List