2.7
Low
CVE-2026-84745 The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to…
Description
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| The Events Calendar 6.17 | earliest → < 6.17.3.1 | 6.17.3.1 |
Other CVEs of The Events Calendar
The 11 CVEs of The Events Calendar →
CVE-2026-84740
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an…
6.5
Medium
CVE-2026-84743
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its…
3.8
Low
CVE-2026-84742
The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before…
2.7
Low
CVE-2026-84741
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding…
5.3
Medium