{"id":"CVE-2026-110069","state":"PUBLISHED","title":"Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions","description":"The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.","publishedAt":"2026-10-18T06:00:16.169Z","updatedAt":"2026-10-18T11:12:30.423Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Modern Events Calendar Lite"],"affected":[{"vendor":"Unknown","product":"Modern Events Calendar Lite","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.37.0","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/5d5a24fe-1fb9-48ae-bd5c-de95b04c5f21/"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:10:33.477Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/110xxx/CVE-2026-110069.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-110069","state":"PUBLISHED","datePublished":"2026-10-18T06:00:16.169Z","dateUpdated":"2026-10-18T11:12:30.423Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-10-13T15:47:51.910Z"},"containers":{"cna":{"title":"Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions","descriptions":[{"lang":"en","value":"The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site."}],"affected":[{"vendor":"Unknown","product":"Modern Events Calendar Lite","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.37.0","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5d5a24fe-1fb9-48ae-bd5c-de95b04c5f21/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-10-18T06:00:16.169Z"},"credits":[{"lang":"en","value":"Usama Arshad","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-110069","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T10:56:40.366488Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","lang":"en","type":"CWE","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-18T11:12:30.423Z"}}]}}}