CVE-2026-84741

MediumCVSS 5.3/10Last modified Sep 23, 2026

Description

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Unknown	The Events Calendar	>= 4.5, < 6.17.5

References

https://wpscan.com/vulnerability/0f34a90e-3d8b-4a87-a2ed-fe4d2c481732/

Timeline

Published: Sep 23, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-847422.7The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it CVE-2026-847433.8The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, al CVE-2026-847446.5The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them CVE-2026-847452.7The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public RES CVE-2026-847477.5Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to by CVE-2026-847487.5Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the pu CVE-2026-847506.5The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of CVE-2026-847528.8Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.CVE-2026-847539.8Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.CVE-2026-847546.5Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.CVE-2026-847556.5Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.CVE-2026-847567.1Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.