The Modern Events Calendar Lite plugin before 7.37.0 fails to enforce capability, nonce, or ownership verification when handling the mec_event_bookings and mec_attendees AJAX actions. Because of this, any authenticated WordPress user—including those with the low‑privilege Subscriber role—can trigger these endpoints and receive full booking data, including guest names, email addresses, transaction identifiers, and payment amounts. This breach directly compromises the confidentiality of all event reservations on the site.

All installations of the Modern Events Calendar Lite WordPress plugin with a version lower than 7.37.0 are impacted. No further version granularity is available from the CNA, so any build prior to the 7.37.0 release is considered vulnerable.

The vulnerability requires only an authenticated user; the attacker does not need elevated privileges or special network access beyond normal WordPress login credentials. The CVSS score is 4.3, reflecting low to moderate severity. As a result, an individual with a Subscriber account can easily enumerate sensitive booking payloads by sending repeated AJAX requests. The EPSS score is not available, and the CNAs have not listed an official exploitation, but the nature of the data exposed makes the risk of misuse high. The CVE is not yet catalogued in CISA’s KEV, yet the potential for data exfiltration remains significant.