The Modern Events Calendar Lite plugin for WordPress suffers from a Full Path Disclosure vulnerability (CWE-201) in all versions up to 7.21.9. The issue arises from insufficient validation of the 'id' parameter during calendar export functionality, enabling unauthenticated users to retrieve the full path of the web server's file system. This information disclosure does not directly compromise confidentiality, integrity, or availability but may facilitate other attacks if chained with additional vulnerabilities.

The vulnerability allows attackers to obtain the full file system path of the affected web application. This information disclosure has low direct impact but can aid attackers in reconnaissance and in exploiting other vulnerabilities. There is no direct impact on data confidentiality, integrity, or availability from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Since this vulnerability requires chaining with other issues to cause damage, limiting exposure by restricting access to calendar export functionality or applying web application firewall rules to block suspicious requests may reduce risk.