CVE-2026-84741 — The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowi…
Published: 2026-09-23 · CVSS: 5.3 · CVSS 3.1
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7