The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This due improper or insufficient validation of the id property when exporting calendars. makes it possible unauthenticated attackers retrieve full path web application, which can be used aid other attacks. The information displayed not useful on its own, requires another vulnerability present damage an affected website.