CVE-2026-84745: The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
The Events Calendar (WordPress plugin)to a version that resolves this vulnerability.Fixed in 6.17.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with a low-privilege WordPress role such as Contributor can exploit it. The issue allows them to read unpublished event, venue, and organizer records, including records created by other users.
Is public or anonymous access required for exploitation?
No. The available information identifies low-privilege authenticated users, such as Contributors, as the relevant attackers; it does not state that unauthenticated visitors can access the content.
What should be prioritized if the plugin cannot be updated immediately?
Restrict or remove low-privilege accounts that do not need access, particularly Contributor accounts, because they can query the affected public REST archives. Review unpublished event, venue, and organizer content for sensitive information that may have been exposed.
How can administrators assess potential exposure?
Identify whether the site uses a version of The Events Calendar earlier than 6.17.3.1 and whether Contributor or similarly low-privilege accounts exist. Exposure concerns apply to unpublished event, venue, and organizer records, including content owned by other users.