The Events Calendar CVE-2026-119367

Exploitation requires an authenticated WordPress account with at least low privileges (CVSS PR:L) on a site running The Events Calendar plugin version through 6.18.2; no user interaction is needed (UI:N) and the request is remote over the network (AV:N). The practical reach depends on the site allowing low-privilege/self-registered accounts (e.g. subscriber), which is common on event and membership sites but not universal - on sites that disable open registration, an attacker must first obtain valid credentials. The description states only that the flaw stems from incorrectly configured access-control security levels (missing authorization); the exact vulnerable feature, endpoint, or configuration that triggers it is not described in the available sources. Limiting factors: authentication is mandatory (not unauthenticated), and impact is limited to low confidentiality and low integrity with no availability effect.

This is a medium-severity (CVSS 5.4) missing-authorization / broken access control flaw (CWE-862) in the widely-used The Events Calendar WordPress plugin, scored CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The vector indicates a network-reachable, low-complexity attack that requires low-privilege authentication (PR:L) and no user interaction, with limited confidentiality and integrity impact and no availability impact. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis - the single reference is a Patchstack advisory, not working exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with the moderate signals: real but not urgent. The main thing that keeps this above trivial is the plugin's large install base combined with the fact that any registered low-privilege account (common on membership/event sites that allow self-registration) can likely reach the vulnerable path. No KEV and no EPSS means there is no evidence of active or predicted-widespread exploitation; prioritize patching on a routine (monthly) cadence rather than as an emergency.

An attacker who holds or self-registers a low-privilege account (e.g. subscriber) on a WordPress site running The Events Calendar ≤6.18.2 sends a request to a plugin endpoint that fails to properly check the caller's authorization level, letting them read or modify event-related data they should not be able to access. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, this is a straightforward authenticated remote request with no user interaction required. No public exploit code is identified at time of analysis; the exact vulnerable endpoint and trigger are not described in the available sources.