Security Alert Summary
The Events Calendar plugin before 6.17.5 fails to perform a per-object capability check on one family of its REST write routes. This allows users with low-privilege roles, such as contributor, to modify, unpublish, trash, and take ownership of records belonging to other users, including administrators.
CVE Details
- CVE ID:
CVE-2026-84743 - Affected component: The Events Calendar WordPress plugin
- Affected versions: Versions before 6.17.5 (example entry in metadata: 6.15.16.1 marked as affected)
- Published: September 23, 2026 at 6:17:03 AM
- Last modified: September 23, 2026 at 11:17:13 AM
- CVSS v3.1: Base Score 3.8, Severity LOW
- Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
- Authentication / Privileges Required / User Interaction: Requires authenticated user with high privileges (PR:H); user interaction: None
- Primary impact: Confidentiality: None; Integrity: Low; Availability: Low
- Weakness: CWE-863 (Incorrect Authorization)
Technical Details
The plugin does not perform a per-object capability check on one family of its REST write routes. As a result, users assigned a low-privilege role such as contributor can perform write actions on records owned by other users. The actions noted in the description include modifying records, unpublishing or trashing them, and taking ownership of records belonging to other users, including administrators.
No specific function names or REST endpoint paths are provided in the available data; the issue is described at the level of a family of REST write routes and a missing per-object authorization check. The root cause is an authorization failure where the plugin fails to validate that the requesting user has the required capability for the specific object being modified.
Impact is limited to the integrity and availability of affected records: content can be altered, unpublished, trashed, or reassigned without the expected authorization checks. There is no CVSS-indicated confidentiality impact for this issue.
How This Could Impact Your Website
In a typical WordPress site with multiple users, this vulnerability could let a low-privilege contributor change or remove content created by other users. For example, an internal contributor could unpublish or trash posts created by an editor or administrator, or reassign posts to themselves. This undermines content integrity and can disrupt publication workflow.
Although the CVSS data indicates confidentiality impact as none, modifying authorship or publishing status can indirectly affect visibility and trust relationships on the site and may increase the risk of targeted social engineering or phishing using known usernames. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and privileges, especially for contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and audit logs for unusual behavior, including unexpected content ownership changes or unpublished content.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
