The flaw is a missing authorization oversight in Webnus Inc.'s Modern Events Calendar plugin, where incorrectly configured security levels grant users unintended access to functions or data the plugin protects. This can allow a user to read or modify event information, user data, or configuration settings that should be limited to higher‑privileged accounts, effectively enabling privilege escalation within the WordPress installation.

All installations of the Modern Events Calendar plugin version 7.29.0 and earlier are impacted; the vendor is Webnus Inc. and the product is the WordPress plugin Modern Events Calendar.

The CVSS score of 5.3 shows moderate severity, while an EPSS score of 3% suggests a low but non‑zero likelihood of exploitation; the flaw is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is a standard web request to the plugin’s endpoints, requiring no special initial conditions beyond accessing the site. Any user could exploit this misconfiguration to read or alter protected data, while authenticated users lacking sufficient permissions could still execute higher‑privilege functions, presenting a meaningful risk to confidentiality, integrity, and availability of the site’s event data.