CVE-2026-84741 in The Events Calendar Plugin
Summary
by MITRE • 09/23/2026
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in The Events Calendar WordPress plugin prior to version 6.17.5 represents a significant information disclosure flaw rooted in insufficient access control mechanisms within the application's public REST API endpoints. This issue specifically affects how the plugin handles linked records, which are typically associated with events or other content structures managed by the software. When these linked records contain stored details that need to be displayed on the frontend of a website, the plugin constructs an API response containing this data. However, the underlying logic fails to perform a critical validation step: it does not verify whether the post status of the linked record is set to public or published before including its contents in the response sent back to the client. This oversight creates a direct pathway for unauthorized access to sensitive internal data that was never intended for public consumption.
From a technical perspective, this flaw constitutes an improper authorization vulnerability where the application relies on implicit trust rather than explicit verification of user permissions and resource visibility states. In standard WordPress architecture, posts with statuses such as draft, pending review, or private are explicitly restricted from being accessed by unauthenticated users through normal browsing channels. The REST API is designed to respect these same restrictions, ensuring that only content marked for public display is exposed via programmatic interfaces. By bypassing the check on post status during the embedding process of linked records, the plugin effectively treats all stored data as publicly accessible regardless of its actual visibility settings. This allows any individual with knowledge of the API endpoint and the necessary parameters to retrieve detailed information about unpublished or private entities associated with public events.
The operational impact of this vulnerability is substantial for organizations relying on The Events Calendar for managing sensitive scheduling, internal meetings, or confidential event planning. Unauthenticated attackers can exploit this flaw to enumerate and extract data that should remain hidden from external observers. This could include details such as attendee lists, private notes attached to events, location specifics for restricted areas, or other metadata embedded within the linked records. Such exposure violates fundamental principles of confidentiality and integrity, potentially leading to privacy breaches, competitive intelligence theft, or further exploitation if the disclosed data contains credentials or additional sensitive identifiers. The lack of authentication requirement means that this attack can be conducted remotely without any prior login, significantly lowering the barrier for entry and increasing the likelihood of successful exploitation by automated tools scanning for vulnerable instances.
This vulnerability aligns with CWE-200, which classifies exposure of information to unauthorized actors, as well as CWE-862, describing missing authorization checks in API responses. In terms of offensive security frameworks like MITRE ATT&CK, this behavior facilitates the Reconnaissance phase, specifically under techniques related to Gathering Victim Organization Information or Exploiting Public-Facing Applications for Data Collection. Attackers can use automated scripts to iterate through various event IDs and linked record identifiers to build a comprehensive profile of an organization's internal operations without triggering typical intrusion detection systems that monitor for brute-force login attempts.
To mitigate this risk, administrators must immediately upgrade The Events Calendar plugin to version 6.17.5 or later, where the developers have implemented proper checks to ensure that only published posts are included in public API responses. Until an update is applied, site owners should consider implementing additional security layers such as Web Application Firewalls configured to restrict access to specific REST API endpoints if they are not actively used for external integrations. Furthermore, it is advisable to audit the usage of linked records within existing events to ensure that no sensitive information was inadvertently exposed prior to patching. Regularly monitoring server logs for unusual patterns in REST API requests can also help detect potential exploitation attempts and provide early warning signs of active attacks targeting this specific weakness.