EUVD-2026-89926
GHSA-p6q2-vcgm-wf96
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor account on target site
-
ExploitSend crafted request to under-protected plugin endpoint
-
ExecutionBypass missing capability check
-
ImpactPerform unauthorized low-impact action affecting integrity/availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid Contributor-level (or higher) account on a WordPress site running The Events Calendar plugin version 6.17.5 or earlier; exploitation is remote over the network with low complexity and no user interaction (PR:L, AC:L, UI:N). The primary limiting factor is the need for authenticated Contributor access - sites that do not permit open Contributor registration or that tightly control low-privilege accounts substantially reduce exposure. Impact is bounded to low integrity and availability effects with no confidentiality loss. |
| Impact | This is a genuine but low-to-moderate priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4 Medium) indicates a network-reachable, low-complexity flaw requiring only Contributor-level authentication (PR:L) and no user interaction, but with limited impact: no confidentiality loss (C:N) and only low integrity and availability impact (I:L/A:L). Per the CWE-862 (Missing Authorization) classification, a low-privileged Contributor can perform actions or reach functionality that should be restricted, but the constrained impact metrics show this does not yield data disclosure or full compromise. No EPSS score, KEV listing, POC, or SSVC data is provided in the input, so there is no signal of active or automated exploitation - the exploitation status is 'no public exploit identified at time of analysis'. The 5.4 score is driven more by easy network reachability than by severe impact; combined with the requirement for a valid Contributor account (a non-trivial precondition on well-managed sites), this is a real-but-modest issue rather than an urgent one. Note the input tag 'Authentication Bypass' is imprecise: CWE-862 describes an authorization (broken access control) failure by an already-authenticated user, not authentication bypass. |
| Exploit ScenarioDerived | An attacker who has obtained or been granted a Contributor account on a WordPress site running The Events Calendar <= 6.17.5 sends crafted requests to a plugin endpoint that fails to enforce proper capability checks, allowing them to modify or trigger functionality beyond their intended role (limited integrity/availability impact). No user interaction is required. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Broken access control in The Events Calendar WordPress plugin through version 6.17.5 allows an authenticated Contributor-level user to perform actions that should be reserved for higher-privileged roles, resulting in low integrity and availability impact with no confidentiality loss. The flaw is network-reachable with low attack complexity and no user interaction required, but it hinges on the attacker already holding a valid Contributor (or higher) account, so sites that do not allow open Contributor registration or that tightly control low-privilege accounts are substantially less exposed. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the assessed severity is 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - a genuine but low-to-moderate priority issue.
RemediationAI
Patch status is not confirmed by the available data: the affected range is through 6.17.5, but no exact fixed version is provided in this feed, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-17-5-broken-access-control-vulnerability?_s_id=cve) and the The Events Calendar/Nexcess release notes to identify the earliest patched release, then update the plugin to that version or later - newer plugin builds are the primary and lowest-risk fix. Until an update is applied, reduce exposure by curtailing the attacker prerequisite: disable open user registration and any front-end Contributor submission flow, and audit existing accounts so that Contributor (and any custom low-privilege role) is granted only to vetted users; the trade-off is loss of self-service content submission, which may disrupt editorial workflows. Additional compensating controls include temporarily deactivating The Events Calendar if its event features are not business-critical (side effect: calendars, event pages, and RSVP/ticketing stop functioning), and applying a WAF or virtual-patching rule that blocks or restricts access to the plugin's AJAX/REST endpoints for unauthenticated or low-privilege sessions (side effect: legitimate front-end calendar rendering and submission actions can break if rules are too broad, so scope rules to the affected actions and monitor logs). After remediation, review plugin-related content for unauthorized modifications given the low integrity impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Events Calendar is a widely deployed WordPress plugin maintained by Nexcess that adds event, calendar, and ticketing functionality; the affected component is identified by CPE cpe:2.3:a:nexcess:the_events_calendar:*:*:*:*:*:*:*:*, i.e. the plugin itself across all configurations up to the stated version. The root cause class is CWE-862 (Missing Authorization): a function, route, or action handler reachable by a low-privileged user lacks the capability check (such as current_user_can with the appropriate role/capability) needed to confirm the caller is entitled to perform it. In WordPress plugins this typically surfaces through AJAX handlers (admin-ajax.php actions), REST API routes with an overly permissive permission_callback, or admin-post.php handlers that rely on a nonce for CSRF protection but not for authorization. Because WordPress role capabilities such as Contributor are assigned by the site, the practical security boundary is the site's user-registration policy. The CVSS vector (PR:L, AC:L, UI:N, S:U, C:N/I:L/A:L) confirms the attacker must be authenticated at a low privilege level, needs no victim interaction, and can only affect integrity and availability within the plugin's scope, without reading protected data or escaping the vulnerable component's security authority.
Know when The Events Calendar gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-reachable endpoint with low complexity, requires an authenticated Contributor (PR:L), no interaction; missing authorization yields only limited integrity/availability impact and no confidentiality loss.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in The Events Calendar
View allRemote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6
The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering som
The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated
Unauthenticated shortcode injection in The Events Calendar WordPress plugin before 6.17.5.1 allows remote attackers to t
The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not pr
Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated at
PHP object injection in The Events Calendar WordPress plugin (all versions through 6.17.4, published by Liquid Web / Ste
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauth
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_
Blind SQL injection in The Events Calendar WordPress plugin (versions 6.15.12 through 6.16.2) by Liquid Web / StellarWP
Integrity bypass in The Events Calendar WordPress plugin allows unauthenticated attackers to mark existing Event Aggrega
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticat
Exploit-DB