Modern Events Calendar Lite EUVD-2026-103397

Requires a valid authenticated account at the Subscriber role or higher on a WordPress site running Modern Events Calendar Lite before 7.36.4 - achievable wherever open user self-registration is enabled. No admin or editor privileges are needed and no victim interaction is required (UI:N). The exploit targets the plugin's post-update handler, which fails to verify ownership of the referenced post ID, so any post/page/custom-post-type is reachable regardless of author. Limiting factors: the attacker must hold at least Subscriber credentials (PR:L), the vulnerable plugin must be installed and below 7.36.4, and impact is confined to content integrity (no data disclosure or denial of service).

Signals point to a genuine but moderate-priority issue rather than an emergency. The CVSS 3.1 base of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) reflects an integrity-only impact: a low-privileged, authenticated attacker can remotely tamper with content but cannot read protected data or cause downtime. CISA's SSVC framework aligns with lower urgency - Exploitation: none, Automatable: no, Technical Impact: partial - consistent with the absence of any CISA KEV listing. However, publicly available exploit code exists (WPScan), so the barrier to abuse is low once an attacker holds a Subscriber account. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here. The key tension is POC-available-but-not-actively-exploited: public exploit code raises opportunistic risk, yet SSVC Exploitation:none and the lack of KEV indicate it is not yet weaponized at scale. Net: patch promptly, especially on sites that allow open user registration, but this is not a drop-everything critical.

An attacker registers (or uses) a low-privilege Subscriber account on a WordPress site running Modern Events Calendar Lite before 7.36.4 and issues a crafted post-update request referencing another user's post ID. Because the plugin never checks that the requester is authorized to edit the target object, the attacker overwrites the title, content, and excerpt of arbitrary posts, pages, or custom post types. Publicly available exploit code from WPScan lowers the effort required, and the low attack complexity (AC:L) and network vector (AV:N) make the action straightforward once authenticated.