CVE-2026-110069 in Modern Events Calendar Lite Plugin
Summary
by MITRE • 10/18/2026
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in Modern Events Calendar Lite versions prior to 7.37.0 represents a critical failure in access control mechanisms within the WordPress plugin ecosystem. This flaw stems from an insufficient verification process during the handling of sensitive event booking and attendee data requests. Specifically, the application fails to enforce capability checks, which would restrict actions based on user roles; it neglects nonce validation, which is essential for preventing Cross-Site Request Forgery attacks by ensuring that requests originate from legitimate sources; and it omits ownership verification, meaning there is no check to confirm that the requesting user has a direct relationship with or permission to access the specific data being requested. This combination of missing security controls creates an environment where any authenticated user can interact with endpoints designed for administrative or restricted operations without proper authorization.
The operational impact of this vulnerability is severe due to its broad scope and low barrier to entry. Because the flaw affects users at the lowest privilege level, such as Subscribers, it allows virtually anyone who has registered on the website to exploit the issue. An attacker can retrieve comprehensive details regarding every booking made on the site. This includes personally identifiable information (PII) such as names and email addresses of attendees, which poses significant privacy risks under regulations like GDPR or CCPA. Furthermore, the disclosure extends to financial data including transaction IDs and payment amounts. The exposure of this sensitive commercial information not only compromises user privacy but also undermines the integrity of the booking system and can lead to reputational damage for the site administrators who rely on trust and security for their services.
From a technical classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves unauthorized access to restricted data due to flawed authorization logic. It also relates closely to CWE-359 Exposure of Private Information Within an Online Service, given the direct disclosure of personal and financial details. In terms of adversary tactics, this exploitation method corresponds to ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to gain access to resources they should not be able to reach. The lack of nonce validation further exposes the system to potential CSRF-based exploitation vectors described in CWE-352 Cross-Site Request Forgery, although the primary impact here is data exfiltration rather than state-changing actions.
To mitigate this vulnerability and prevent similar issues in future development, it is imperative that developers implement strict server-side authorization checks for all API endpoints handling sensitive data. This includes verifying user capabilities against WordPress role definitions to ensure only authorized roles can access specific functions. Implementing nonces for all form submissions and AJAX requests adds a layer of CSRF protection and ensures request authenticity. Additionally, ownership verification must be enforced by validating that the authenticated user is either an administrator or the owner of the specific booking record being accessed. Regular security audits and adherence to secure coding standards are essential to maintain robust access control policies within WordPress plugins.