Modern Events Calendar CVE-2026-110069

Requires only a valid low-privilege authenticated account (Subscriber) per the CVSS PR:L metric - practically exploitable wherever open user registration is enabled, which is common on sites using an event-booking plugin. The specific prerequisite is that the site runs Modern Events Calendar Lite before 7.37.0 and has at least one booking record to disclose. The vulnerable booking/attendee data endpoint performs no capability, nonce, or ownership checks, so no admin role, no CSRF token, and no record ownership is needed. Limiting factors: exploitation is not possible by a fully unauthenticated attacker (an account is required), there is no integrity or availability impact (read-only disclosure), and impact is confined to data handled by the plugin's booking module.

This is a genuine but moderate-priority issue, not a critical one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) confirms network-reachable, low-complexity exploitation requiring only low privileges (any logged-in Subscriber) with no user interaction and no integrity or availability impact. Publicly available exploit code exists (WPScan), which raises practical risk and lowers the skill barrier, but there is no CISA KEV listing and SSVC records Exploitation as 'none', so there is no evidence of active exploitation - treat the POC as proof-of-concept, not confirmed in-the-wild abuse. No EPSS score was provided, so exploitation probability cannot be quantified from the input. SSVC (Automatable: no, Technical Impact: partial) aligns with the low CVSS: the flaw leaks data but does not grant system control and is not described as automatable at scale. The signals are consistent with each other - a real, easy-to-exploit confidentiality leak of moderate impact. The one point worth independent scrutiny is impact scope: the description says EVERY booking's names, emails, transaction IDs and payment amounts are exposed, which is bulk PII/financial disclosure; the vendor-rated C:L may understate this, as mass PII exposure is arguably a high confidentiality impact (see assessed vector).

An attacker registers a free Subscriber account on any WordPress site running Modern Events Calendar Lite below 7.37.0 - self-registration is commonly enabled on event/booking sites. They then invoke the unprotected booking/attendee endpoint, which performs no capability, nonce, or ownership check, and receive the full list of every booking including attendee names, email addresses, transaction IDs and payment amounts. A publicly available exploit (WPScan) demonstrates the request, so no original research is needed.