CVE-2026-84743 in The Events Calendar Plugin
Summary
by MITRE • 09/23/2026
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in The Events Calendar WordPress plugin prior to version 6.17.5 represents a critical failure in access control mechanisms within the application's REST API implementation. Specifically, the flaw resides in one family of write-oriented routes that handle modifications to event records and related data structures. In secure software architecture, particularly for content management systems like WordPress, it is imperative that every state-changing operation verifies not only whether the user has permission to perform an action but also whether they have authority over the specific object being modified. This vulnerability stems from a missing per-object capability check, meaning the system validates the user's general role or privilege level against the endpoint itself but fails to validate ownership or administrative rights relative to the individual record ID provided in the request payload.
From a technical perspective, this oversight allows authenticated users with low-privilege roles, such as contributors or authors, to bypass intended restrictions and execute write operations on resources they do not own. By manipulating the unique identifiers associated with event records, these attackers can issue HTTP requests that modify, unpublish, trash, or transfer ownership of events created by other users, including those holding administrator privileges. This behavior violates the principle of least privilege and demonstrates a classic authorization flaw where identity verification is decoupled from resource-level permission checks. The attacker does not need to exploit any input validation issues or injection techniques; rather, they simply leverage valid API endpoints with crafted parameters that target arbitrary object identifiers within the database.
The operational impact of this vulnerability is severe due to its potential for data integrity compromise and privilege escalation effects within the context of a WordPress site. An adversary can disrupt business operations by trashing critical event listings or unpublishing content, leading to service disruption and reputational damage. Furthermore, taking ownership of records belonging to administrators allows the attacker to maintain persistent access even if initial credentials are compromised or rotated. This capability effectively neutralizes administrative controls because the attacker gains full control over high-value assets without needing elevated system privileges initially. The ability to modify existing data also poses risks for misinformation campaigns or defacement if the event details contain public-facing information such as dates, locations, and descriptions.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-862, which describes Missing Authorization, specifically failing to enforce permissions on specific resources rather than just endpoints. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies on legitimate credentials of low-level users being used for unauthorized actions. Additionally, it relates to CWE-639, Authorization Bypass Through User-Controlled Key, where the attacker controls the key (the event ID) that determines access rights. The lack of server-side validation against user-specific ownership tables is a fundamental architectural defect in the plugin's REST API handler logic.
To mitigate this risk, organizations running affected versions must immediately upgrade The Events Calendar to version 6.17.5 or later, where the per-object capability checks have been implemented and validated by the developers. Until an update can be applied, administrators should consider restricting access to the specific vulnerable REST endpoints using web application firewall rules if possible, although this is a less robust solution than patching. It is also recommended to audit recent activity logs for any signs of unauthorized modifications or ownership transfers that may have occurred during the window of exposure. Regular security assessments and code reviews focusing on authorization logic in custom plugins are essential preventive measures against similar vulnerabilities in WordPress ecosystems.