The Events Calendar EUVD-2026-85040

Exploitation requires an authenticated WordPress account with a low-privilege role (Contributor or higher) on a site running The Events Calendar plugin version 6.15.16.1 through before 6.17.5. The specific enabling flaw is a missing per-object capability check on one family of the plugin's REST write routes; no admin rights, user interaction, or non-default configuration is needed beyond the attacker possessing such an account. Limiting factors: the attacker must already hold or be able to register a contributor-level account (self-registration or multi-author setups make this trivial; single-admin sites without open registration raise the bar), and impact is confined to content integrity/availability (modify, unpublish, trash, take ownership) with no data disclosure.

This is a genuine but low-severity broken-access-control flaw (CWE-863), not a high-CVSS scare. The vendor CVSS 3.1 base is 3.8 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) - network-reachable and low-complexity, but requiring privileges and yielding only limited integrity/availability impact with no confidentiality loss. There is a notable internal inconsistency: the description explicitly states the attacker needs only 'a low-privilege role such as contributor,' which corresponds to PR:L, yet the published vector encodes PR:H - this discrepancy understates likelihood of exploitation and should be verified with WPScan/the vendor (my independent assessment uses PR:L). No EPSS score, KEV listing, or public POC was provided in the intelligence, so there is no signal of active or automated exploitation; the SSVC posture is effectively low (authenticated prerequisite, bounded technical impact, not automatable at scale). Overall this is a routine patch-in-normal-cycle issue rather than an emergency, elevated slightly because the affected accounts (contributors) are commonly granted on multi-author WordPress sites and the flaw lets them tamper with administrators' content.

On a multi-author WordPress site running The Events Calendar before 6.17.5, an attacker who holds (or registers/obtains) a Contributor account sends a crafted request to the vulnerable REST write route, which fails to perform a per-object capability check. They then modify, unpublish, trash, or reassign ownership of events and records created by other users, including administrators. No public exploit code was identified at time of analysis; exploitation is straightforward (AC:L) but requires an authenticated low-privilege account.