The Events Calendar CVE-2026-119368

Exploitation requires an affected installation of the The Events Calendar WordPress plugin at any version up to and including 6.18.2, active on a reachable site. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed, implying default-configuration exploitability over the network. The specific product feature, endpoint, or AJAX/REST action that lacks the authorization check is not described in the available sources, so the precise trigger is unverified. Limiting factors: impact is confined to low confidentiality (C:L, no integrity or availability effect), meaning the realistic outcome is disclosure of restricted data rather than site takeover; sites not running this plugin, or running a fixed version once released, are unaffected.

This is a medium-severity issue (CVSS 5.3) whose signals are internally consistent and point to a real-but-not-urgent priority rather than a top-tier emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity vulnerability requiring no privileges (PR:N, i.e. unauthenticated) and no user interaction, but impact is capped at low confidentiality only (C:L/I:N/A:N), consistent with a missing-authorization (CWE-862) flaw exposing data that should be access-controlled rather than enabling code execution or data modification. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and there is no verified public exploit code, so there is no evidence of active exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the moderate CVSS and absence of exploitation signals. One caveat: the 'Authentication Bypass' tag overstates the issue - CWE-862 is a missing authorization (broken access control) weakness, not an authentication bypass, and the Patchstack reference title itself describes it as 'broken access control'. Net: schedule patching within normal cycles; the unauthenticated/network reach warrants attention, but the low, confidentiality-only impact keeps it below critical priority.

A remote, unauthenticated attacker sends a crafted request to a The Events Calendar endpoint that fails to enforce proper authorization checks, causing the plugin to return information that should be restricted. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no login, no victim interaction, and only low attacker skill are needed against an affected site. No verified public exploit code was identified; the specific vulnerable endpoint and trigger are not described in the available sources.