CVE-2026-84745 in The Events Calendar Plugin
Summary
by MITRE • 09/05/2026
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in The Events Calendar WordPress plugin prior to version 6.17.3.1 represents a critical failure in access control mechanisms within the application's public REST API endpoints. This flaw specifically affects how content visibility is enforced during archive requests, allowing unauthorized entities to bypass intended privacy restrictions. In standard web application architecture, particularly those built on frameworks like WordPress, it is imperative that server-side logic strictly validates user permissions before returning sensitive data. However, in this instance, the plugin fails to adequately filter non-public or unpublished posts when they are accessed through public-facing REST API routes designed for listing events and archives. This architectural oversight means that the visibility status of a post does not serve as an effective barrier against unauthorized retrieval via these specific endpoints.
From a technical perspective, the core issue lies in the improper implementation of access control checks within the REST controller logic. When a request is made to retrieve archive data, the system should verify whether the requesting user has the appropriate role and capabilities to view unpublished content. Instead, the plugin returns full details for all records regardless of their publication status or the requester's privilege level. This behavior effectively exposes internal state information that was intended to remain hidden from public consumption. The flaw is particularly severe because it leverages a standard API interface that is often accessible without authentication, thereby widening the attack surface significantly compared to authenticated administrative interfaces where such checks might be more rigorously applied.
The operational impact of this vulnerability is substantial for organizations relying on WordPress and The Events Calendar plugin for their event management needs. Users with low-privilege roles, such as contributors or subscribers, can exploit this flaw to read the full contents of every unpublished record hosted on the site. This includes sensitive information belonging to other users, internal drafts, private announcements, or confidential scheduling details that have not yet been made public. The exposure of unpublished records compromises data confidentiality and integrity, potentially leading to reputational damage if proprietary event strategies are leaked. Furthermore, this access can facilitate further attacks by providing attackers with contextual information about the site's structure, user roles, and internal workflows, which could be leveraged for social engineering or targeted exploitation of other vulnerabilities.
This vulnerability aligns closely with CWE-284, Improper Access Control, as it involves a failure to enforce proper restrictions on authorized access to specific data objects. Additionally, from the perspective of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates Data Staging and Collection activities by allowing an attacker to gather sensitive information without needing elevated privileges or valid credentials for restricted areas. The lack of authentication requirements for these REST endpoints exacerbates the risk, making it a high-severity issue that requires immediate attention.
To mitigate this vulnerability, site administrators must upgrade The Events Calendar plugin to version 6.17.3.1 or later, where the access control logic has been corrected to properly restrict non-public content based on user permissions. Until an update can be applied, temporary mitigations may include restricting access to the WordPress REST API through web application firewall rules if feasible, although this is not a complete solution as it may impact legitimate functionality. It is also advisable to audit other plugins for similar patterns of improper access control in their API endpoints and ensure that all software components are kept up to date with security patches provided by vendors. Regular vulnerability assessments and penetration testing should be conducted to identify and remediate such logic flaws before they can be exploited in production environments.