The Modern Events Calendar Lite plugin for WordPress contains a full path disclosure flaw that is triggered during the export of a calendar. This occurs because the plugin does not properly validate the id parameter. The weakness is classified as CWE-201 (Information Exposure) due to insufficient validation of the ID parameter when exporting calendars. An unauthenticated attacker can trigger the export endpoint and obtain the absolute file system path of the WordPress installation. The disclosed data alone is not immediately sensitive but can facilitate reconnaissance or the planning of further attacks.

The vulnerability affects all releases of the Modern Events Calendar Lite plugin distributed by webnus that are version 7.21.9 or earlier. These versions are available to WordPress sites that use the plugin.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation in the wild is unlikely. The vulnerability is not listed in the CISA KEV catalog. Because the path disclosure can be obtained without authentication, an attacker can easily obtain the information, but this alone does not enable a direct compromise. It may, however, aid subsequent attacks if another vulnerability is present.