The vulnerability resides in the Modern Events Calendar Lite WordPress plugin before version 7.36.4. It fails to verify that the calling user is authorized to edit the target post when a request is made to update it. As a result, an authenticated user with the Subscriber role can alter the title, content, and excerpt of any post, page, or custom post type that was created by a different user. This flaw allows a subscriber to tamper with content that they should not be able to modify, potentially leading to incorrect information being displayed, defacement, or the insertion of malicious text on a website. The weakness is an instance of an Insecure Direct Object Reference, where user input directly determines the object being accessed without proper authorization checks, and it also represents improper access control.

Any WordPress site that has installed Modern Events Calendar Lite plugin of a version earlier than 7.36.4 is compromised. The affected product is the plugin itself; no specific operating systems or hosting environments are listed, so the flaw applies to all deployments running the vulnerable plugin.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The Exploit Probability Score (EPSS) is not available, so the likelihood of exploitation is undetermined; however, subscribers are a common user role, increasing the potential attack surface. Since this vulnerability is not listed in CISA KEV, there is no current catalog indication of active exploitation. The attack vector is inferred to be local (within the WordPress instance) due to the need for authentication, but the impact on content integrity and availability is significant.