Unauthenticated Data Exposure in Modern Events Calendar Lite

Executive Summary

This vulnerability affects the Modern Events Calendar Lite WordPress plugin versions before 7.37.0. It allows any authenticated user, including those with Subscriber-level access, to access sensitive event booking and attendee data without proper checks. The data includes names, email addresses, transaction IDs, and payment amounts for all bookings on the site.

Useful 0 Not Useful 0

Detection Guidance

Check if the Modern Events Calendar Lite plugin version is below 7.37.0. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected plugin version, attackers with basic user access could steal personal and financial data of all event attendees. This could lead to privacy breaches, identity theft, or fraud. The vulnerability exposes sensitive information like email addresses, payment details, and transaction records.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and failure to protect user information. It may also breach HIPAA if health-related event data is exposed. Organizations could face legal penalties, fines, and reputational damage for non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Modern Events Calendar Lite plugin to version 7.37.0 or later immediately to patch the vulnerability.

Useful 0 Not Useful 0