Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.8
CVE-2026-84743: The Events Calendar plugin lets low‑privilege users change others’ events
CVE-2026-84743 · published 26 days ago
Summary
The Events Calendar WordPress plugin lets users with a contributor role edit, delete, trash, or take ownership of events, venues, and organizers that belong to other users, including administrators, through certain API calls. This could let someone change or remove important calendar data without proper permission. Update the plugin to the latest version (6.17.5 or newer) or restrict access to those API routes.
What to do
- Update unknown the events calendar to version 6.17.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | the events calendar | < 6.17.5 |
Original advisory text
The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.8
Low
Type
CWE-863Incorrect Authorization
Timeline
Published23 Sep 2026
Updated19 Oct 2026
First seen23 Sep 2026
Track software like this
Free during beta