What is the CVSS score of CVE-2026-84745?

CVE-2026-84745 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-84745?

Yes, a public proof-of-concept exploit is available for CVE-2026-84745. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-84745?

Yes, a patch is available for CVE-2026-84745. Update the affected software to the latest version immediately.

The Events Calendar CVE-2026-84745

EUVD-2026-71864 LOW

Information Exposure (CWE-200)

2026-09-05 WPScan

GHSA-fp7x-4xgc-f69p

WordPress Information Disclosure The Events Calendar Unknown

2.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Contributor is low-privilege (PR:L, not PR:H); impact is limited to non-public content disclosure (C:L), with no integrity or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 06, 2026 - 11:34 vuln.today

CVSS changed

Sep 06, 2026 - 11:22 NVD

2.7 (LOW)

Patch available

Sep 05, 2026 - 08:01 EUVD

CVE Published

Sep 05, 2026 - 06:00 cve.org

LOW 2.7

CVE Published

Sep 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.

AnalysisAI

The Events Calendar WordPress plugin before 6.17.3.1 exposes unpublished site content - drafts, pending posts, and private records from all users - through its public REST API archive endpoints to any contributor-level authenticated user. The plugin fails to enforce WordPress's standard post-status visibility controls on its custom REST routes, allowing a low-privilege account holder to enumerate and read the full body of every non-public record site-wide, bypassing intended access controls. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated WordPress session at contributor level or above on the target site; unauthenticated requests are insufficient, and subscriber-only accounts are likely excluded based on the description's wording ('low-privilege role such as contributor'). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, score 2.7) contains a material discrepancy: it assigns PR:H (high privilege required), but the description explicitly states exploitation is possible with 'a low-privilege role such as contributor.' In WordPress's role hierarchy, contributor is PR:L, not PR:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update The Events Calendar plugin to version 6.17.3.1 or later via the WordPress plugin dashboard or wp-cli ('wp plugin update the-events-calendar'); this is the vendor-confirmed fix per the WPScan advisory at https://wpscan.com/vulnerability/cf23ee00-322c-4443-a50d-a91f90d179aa/. … Detailed patch versions, workarounds, and compensating controls in full report.