CVE-2026-110070

{
  "etk_id": "ETK-2026-2253",
  "cve_id": "CVE-2026-110070",
  "display_id": "CVE-2026-110070",
  "ghsa_id": "GHSA-45vg-m9hg-qm9v",
  "euvd_id": "EUVD-2026-103397",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper post-edit authorization in Modern Events Calendar Lite",
  "summary": "Modern Events Calendar Lite versions before 7.36.4 do not properly authorize edits to the targeted post. An authenticated user with the Subscriber role can modify selected fields of posts, pages, and custom post types belonging to other users.",
  "mitigation": "Upgrade Modern Events Calendar Lite to version 7.36.4 or later. Until upgraded, restrict Subscriber accounts and review unexpected changes to published content.",
  "vendor": null,
  "product": "Modern Events Calendar Lite",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 7.36.4"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "7.36.4"
      ],
      "package_name": "Modern Events Calendar Lite",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 6.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 22.46122331666667,
  "t0_at": "2026-10-18T06:00:16.343000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-21T00:58:41.733902+00:00",
      "days": 2.790571653958333,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T06:00:16.343000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-18T06:00:16.343000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T06:00:16.343000+00:00",
      "url": "https://github.com/advisories/GHSA-45vg-m9hg-qm9v"
    }
  }
}