The Events Calendar CVE-2026-84745

Exploitation requires an authenticated WordPress session at contributor level or above on the target site; unauthenticated requests are insufficient, and subscriber-only accounts are likely excluded based on the description's wording ('low-privilege role such as contributor'). The target must have The Events Calendar plugin installed and active at a version before 6.17.3.1, and the WordPress REST API must be accessible (enabled by default in all modern WordPress installations). Impact is bounded to confidentiality of non-public content (drafts, pending, private posts/events); there is no mechanism for integrity modification or denial of service. Sites where all accounts above subscriber are trusted administrators, or sites with no contributor-level accounts provisioned, are not at practical risk.

The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, score 2.7) contains a material discrepancy: it assigns PR:H (high privilege required), but the description explicitly states exploitation is possible with 'a low-privilege role such as contributor.' In WordPress's role hierarchy, contributor is PR:L, not PR:H. A corrected vector using PR:L yields a base score of approximately 4.3, better reflecting real-world risk. The EPSS score of 0.14% (4th percentile) and the absence from CISA KEV indicate no widespread automated exploitation at time of analysis; however, a public PoC from WPScan lowers the barrier for manual abuse. In multi-author WordPress deployments where contributor accounts are broadly provisioned - common in publishing, media, and event-driven sites - this represents a concrete confidentiality breach covering the full draft corpus of every author. Single-author or admin-only sites face negligible exposure.

An attacker obtains a contributor account on a target WordPress site - through registration if open, social engineering, or credential compromise - and then queries The Events Calendar's REST archive endpoint. The endpoint returns the full text of all unpublished event drafts and private posts across every author on the site. A public PoC documented by WPScan specifies the exact endpoint and request format, making this trivially repeatable with any HTTP client.