CVE-2026-84743

LowCVSS 3.8/10Last modified Sep 23, 2026

Description

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-847446.5The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them CVE-2026-847452.7The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public RES CVE-2026-84747Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to by CVE-2026-84748Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the pu CVE-2026-847506.5The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of CVE-2026-847528.8Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.CVE-2026-847539.8Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.CVE-2026-847546.5Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.CVE-2026-847556.5Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.CVE-2026-847567.1Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.CVE-2026-847578.2Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.CVE-2026-847586.5Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.