Improper Access Control in The Events Calendar Plugin for WordPress
CVE-2026-84745
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-84745?
The Events Calendar plugin for WordPress prior to version 6.17.3.1 has a significant security flaw that allows users with low-privilege roles, such as contributors, to access non-public content through public REST archives. This weakness results in unauthorized disclosure of unpublished records, potentially exposing sensitive information from other users. Site administrators are urged to update to the latest version to secure their installations.
Affected Version(s)
The Events Calendar 0 < 6.17.3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.