WordPress Plugin Vulnerabilities

Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR

Description

The plugin does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.

Proof of Concept

Affects Plugins

Plugin icon
modern-events-calendar-lite
Fixed in 7.36.4

References

CVE
CVE-2026-110070

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Nguyen Duc Thinh
Submitter
Nguyen Duc Thinh
Verified
Yes
WPVDB ID
4c7ff021-da5b-44ff-ac99-142b5bdc0790

Timeline

Publicly Published
2026-10-16 (about 2 days ago)
Added
2026-10-16 (about 1 day ago)
Last Updated
2026-10-16 (about 1 day ago)

Other

Published
Title
Published
2026-07-27
Title
DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR
Published
2024-01-17
Title
MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure
Published
2026-05-27
Title
Timetable and Event Schedule by MotoPress < 2.4.17 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function
Published
2022-12-05
Title
ACF Quick Edit Fields < 3.2.3 - Contributor+ User Metadata Leak via IDOR
Published
2026-09-18
Title
NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update