Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export

Vulnerability

The Modern Events Calendar Lite WordPress plugin versions before 5.16.5 lack proper authorization checks on the export functionality. This allows any unauthenticated user to access export files and retrieve all events data in CSV or XML format [1].

Exploitation

An attacker can exploit this by directly requesting the export endpoints without any authentication or user interaction. No special privileges or network position is required; the attacker simply needs to know or guess the export URL [1].

Impact

Successful exploitation results in the disclosure of all events data, which may include sensitive information such as event details, attendee lists, or other private data. The impact is limited to information disclosure (confidentiality breach) with no direct effect on integrity or availability [1].

Mitigation

The vulnerability is fixed in version 5.16.5 of the plugin. Users should update to this version or later. No workaround is available for earlier versions [1].