Skip to main content

The Events Calendar CVE-2026-13390

| EUVDEUVD-2026-49071 MEDIUM
Missing Authorization (CWE-862)
2026-07-27 WPScan GHSA-h677-jwp7-x89g
Authentication Bypass WordPress The Events Calendar
5.3
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

4
Analysis Generated
Jul 27, 2026 - 15:32 vuln.today
Patch available
Jul 27, 2026 - 07:01 EUVD
CVE Published
Jul 27, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 27, 2026 - 06:00 cve.org
MEDIUM 5.3

DescriptionCVE.org

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.

AnalysisAI

Integrity bypass in The Events Calendar WordPress plugin allows unauthenticated attackers to mark existing Event Aggregator import records as failed and insert arbitrary content into a hidden comment. Public exploit code is available, and the vulnerability is automatable via the REST API, increasing the risk beyond the moderate CVSS score.

More in The Events Calendar

View all
CVE-2024-4180 CRITICAL POC
9.1 Jun 04

The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering som
CVE-2023-6203 HIGH POC
7.5 Dec 18

The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated
CVE-2024-1295 MEDIUM POC
6.5 Jun 14

The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not pr
CVE-2026-78265 CRITICAL
9.8 Aug 24

PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauth
CVE-2024-8275 CRITICAL
9.8 Sep 25

The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_
CVE-2026-49772 CRITICAL
9.3 Jun 16

Blind SQL injection in The Events Calendar WordPress plugin (versions 6.15.12 through 6.16.2) by Liquid Web / StellarWP

CVE-2024-5333 MEDIUM POC
5.3 Dec 16

The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticat
CVE-2025-5144 MEDIUM
6.4 Jun 11

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ paramete
CVE-2024-6931 MEDIUM
6.1 Sep 27

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all ver
CVE-2019-15109 MEDIUM
6.1 Aug 21

The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter. Rated medium severi
CVE-2023-6557 MEDIUM
5.3 Feb 05

The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and

CVE-2024-8493 MEDIUM POC
4.8 May 15

The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow h

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-13390 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy