CVE-2026-84741: The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user who can access the site's public REST API can retrieve stored details from linked venue and organizer records that were never published.
Which installations are affected?
The issue affects The Events Calendar versions before 6.17.5. The affected behavior is in public REST API responses that embed linked venue or organizer details without checking their post status.
What information may be exposed?
Stored content from non-public venue and organizer records may be disclosed when those records are linked to event data returned by the public REST API.