PT-2026-97174 · WordPress · The Events Calendar
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
The Events Calendar WordPress plugin versions prior to 6.17.5
Description
A broken access control issue exists where the software fails to verify the post status of linked records before including their stored details in a public REST API response. This allows unauthenticated users to access and read the contents of non-public venue and organizer records that have not been published. The issue affects over 600,000 active installations.
Recommendations
Update The Events Calendar WordPress plugin to version 6.17.5 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
The Events Calendar