CVE-2026-110069: falha de média gravidade em Modern Events Calendar Lite
Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 4.3epss 0.2%
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Unknown · Modern Events Calendar LitePoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/5d5a24fe-1fb9-48ae-bd5c-de95b04c5f21/não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Modern Events Calendar Lite
No mesmo produto, das mais perigosas para as menos.
CVE-2021-24145—Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCEEPSS 87.2%CVE-2021-24946—Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL InjectionEPSS 72.8%CVE-2022-0364—Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site ScriptingEPSS 69.6%CVE-2021-24146—Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events ExportEPSS 31.0%CVE-2021-24149—Modern Events Calendar Lite < 5.16.6 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24925—Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site ScriptingEPSS 0.8%