CVE-2026-84745
Received Received - Intake

Information Disclosure in The Events Calendar WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: WPScan

Description
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-84745
EUVD
EUVD-2026-71864

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
the_events_calendar the_events_calendar to 6.17.3.1 (exc)
moderntribe the_events_calendar to 6.17.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Events Calendar WordPress plugin before version 6.17.3.1 has a vulnerability where non-public content is not properly restricted in its public REST archives. This allows users with low-privilege roles, such as contributors, to read unpublished records like events, venues, and organizers that should be private.

Detection Guidance

Check the installed version of The Events Calendar plugin. If it is below 6.17.3.1, the vulnerability is present. Use WordPress admin dashboard or run: wp plugin list --name='the-events-calendar' in WP-CLI.

Impact Analysis

This vulnerability exposes sensitive unpublished data to unauthorized users. Attackers with low-level access could view private event details, user information, or other restricted content, potentially leading to data leaks or misuse of confidential information.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing personal or sensitive data to unauthorized individuals. Organizations may face compliance violations, legal penalties, or reputational damage due to unauthorized data access.

Mitigation Strategies

Update The Events Calendar plugin to version 6.17.3.1 or later immediately. If updating is not possible, consider disabling the plugin temporarily until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84745. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart