---
cve: "CVE-2026-110070"
severity: "MEDIUM"
cvss: 6.5
epss: "0.2%"
vendor: "Unknown"
kev: false
exploited: false
published: "2026-10-18 07:16:52"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-07T17:10:08+01:00"
---

# CVE-2026-110070

> 6.5 MEDIUM

## Beschreibung

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.

## CNA-Record (Kanon, cvelistV5)

- CNA: **WPScan**
- State: PUBLISHED
- Stand: 2026-10-18 11:12:30

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-639** — Authorization Bypass Through User-Controlled Key
  The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

## Referenzen

- <https://wpscan.com/vulnerability/4c7ff021-da5b-44ff-ac99-142b5bdc0790/>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-110070/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_