CVE-2026-84742: The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API
The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
The Events Calendar WordPress pluginto a version that resolves this vulnerability.Fixed in 6.17.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with a role that can access the affected REST API but is not normally allowed to publish content, such as a contributor, can exploit it.
What access does an attacker need?
The attacker needs a WordPress account with an insufficient publishing role and must be able to send create or update requests through the TEC V1 REST API. The provided information does not indicate that unauthenticated attackers can exploit it.
Which versions are affected and what version fixes it?
The issue affects The Events Calendar versions before 6.17.5, including versions 6.15.0 through 6.17.4.1. Updating to version 6.17.5 or later addresses the missing publication-capability check.
What can be done if updating is not immediately possible?
Restrict or remove contributor-level accounts and other roles that should not be able to publish content, particularly where they can access the plugin's TEC V1 REST API. Review and limit access to affected WordPress accounts until the plugin can be updated.
How can administrators check for impact?
Review published content created or updated by contributor-level or other non-publishing accounts, especially content that bypassed the normal editorial-review workflow. Also review requests to the TEC V1 REST API from those accounts if relevant logs are available.