The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.

CVE-2026-84741, in The Events Calendar (WordPress, 600,000+ active installs). Wanted to share this here because most CVE hunting content online skips the part that actually matters !!!, the failures...

The bug, in plain terms:

A broken access control issue where non-public venue and organizer data was exposed through the REST API to unauthenticated users

CWE-200, CVSS 5.3. Not glamorous !!. Real, and confirmed independently by the vendor, but not an RCE or a headline bug.

What actually got me here, since that's the part worth sharing:

this came after weeks of hunting smaller WordPress plugins first, mostly ones with under 10,000 installs, specifically to avoid competition while I built up the discipline: always live verify before writing anything, always trace a claimed vulnerability all the way to the actual database write or output before believing it, always check the full advisory history before assuming something is undiscovered.

2 submissions before this one got rejected as duplicates. One was a real, independently confirmedd bug, lost purely because another researcher submitted it hours or days earlier. That one stung, but the rejection email itself confirmed my analysis was correct, just not first. I also had a lead on a much bigger plugin that looked like a critical unauthenticated data write, spent real time on it, and it turned out to be a false positive once I traced the actual code path. Writing that up as dead was more valuable long term than getting excited too early would have been.

Eventually I applied the same instinct, mismatched permission checks on the sibling of a code path that's already gated, to a much bigger target instead of another small plugin. That's what found this one.

Link - https://www.cve.org/CVERecord?id=CVE-2026-84741

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.

The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the htmltag attribute in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.