---
id: CVE-2026-110069
title: >-
  Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure
  via mec_event_bookings and mec_attendees AJAX Actions
summary: >-
  The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not
  perform capability, nonce, or ownership checks before returning event booking
  and attendee data, allowing any authenticated user, including Subscribers, to
  disclose …
severity: none
cwe:
  - CWE-200
product: Modern Events Calendar Lite
affected:
  - modern_events_calendar_lite < 7.37.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T06:00:16.169Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110069'
references:
  - url: 'https://wpscan.com/vulnerability/5d5a24fe-1fb9-48ae-bd5c-de95b04c5f21/'
tags:
  - cve.org
ingestedAt: '2026-10-18T06:38:27.437Z'
---

## Overview

The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.

## Affected

- `modern_events_calendar_lite < 7.37.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.