CVE-2026-119368: WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress The Events Calendarto a version that resolves this vulnerability.Fixed in 6.18.3
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates it can be exploited remotely over the network without authentication or user interaction. No privileges are required.
What impact is indicated?
The reported impact is limited confidentiality impact. The CVSS vector indicates no integrity or availability impact.
Which versions are affected?
The affected range is reported as The Events Calendar versions through 6.18.2. The provided data does not identify a fixed version.