CVE-2026-84741
Received Received - Intake

Unauthenticated Access to Unpublished Event Data in The Events Calendar

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-84741
EUVD
EUVD-2026-85038

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
moderntribe the_events_calendar to 6.17.5 (exc)
moderntribe the_events_calendar 4.5
moderntribe the_events_calendar 6.17.4.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects The Events Calendar WordPress plugin versions before 6.17.5. It allows unauthenticated users to read unpublished event details, venues, or organizers via the REST API because the plugin does not check if records are published before including them in public responses.

Detection Guidance

To detect this vulnerability, check if your WordPress site is running The Events Calendar plugin versions 4.5 to 6.17.4.1. You can use commands like 'wp plugin list' in WP-CLI or inspect the plugin version in the WordPress admin panel. Additionally, test the REST API endpoints for unauthenticated access to unpublished venue or organizer records.

Impact Analysis

Unauthenticated attackers could access private event information, unpublished venues, or organizer details that should not be public. This exposes sensitive data that was never meant to be shared.

Compliance Impact

This could lead to non-compliance with GDPR or HIPAA if unpublished personal or sensitive data is exposed. Organizations may face legal penalties for unauthorized data disclosure.

Mitigation Strategies

Immediately update The Events Calendar plugin to version 6.17.5 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review REST API responses to ensure unpublished records are not exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84741. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart