3.8
Faible
CVE-2026-84743 The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its…
Description
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| The Events Calendar 6.15 | 6.15.16.1 → < 6.17.5 | 6.17.5 |
Autres CVE de The Events Calendar
Les 11 CVE de The Events Calendar →
CVE-2026-84740
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an…
6.5
Moyenne
CVE-2026-84741
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding…
5.3
Moyenne
CVE-2026-84742
The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before…
2.7
Faible
CVE-2026-84745
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to…
2.7
Faible