Modern Events Calendar Lite Full Path Disclosure Vulnerability

A full path disclosure vulnerability has been identified in the Modern Events Calendar Lite plugin for WordPress, affecting all versions through 7.21.9. The issue arises from inadequate validation of the 'id' property during calendar exports, allowing unauthenticated attackers to access the complete file path of the web application. While this information could facilitate further attacks, it is not harmful on its own and requires the presence of another vulnerability to cause damage to the affected website.

Impact

Exploitation of this vulnerability could lead to information exposure, allowing attackers to obtain the full file path of the web application, which could be used to facilitate other attacks.

Remediation

Users are advised to update the Modern Events Calendar Lite plugin to version 7.22 or a newer patched version.