CVE-2026-84743: The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
The Events Calendar WordPress pluginto a version that resolves this vulnerability.Fixed in 6.17.5
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privilege authenticated user, such as a Contributor, can exploit the affected REST write routes. The issue can affect records owned by other users, including administrators.
What actions can an attacker perform through the vulnerable routes?
An attacker can modify, unpublish, trash, or take ownership of Event, Venue, and Organizer records when targeting the affected by-slug REST routes.
Which versions should be remediated?
The affected versions are 6.15.16.1 through 6.17.4.1. Versions before 6.17.5 are described as lacking the required per-object capability check.