CVE-2026-13390: Events Calendar WordPress Auth Bypass Flaw

CVE-2026-13390 Overview

CVE-2026-13390 is a missing authorization vulnerability [CWE-862] affecting The Events Calendar WordPress plugin in versions prior to 6.16.5.1. The plugin fails to perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a specific status value. Unauthenticated attackers can send crafted requests to mark existing import records as failed and to store arbitrary content in a hidden comment record. The flaw enables limited data tampering against WordPress sites running the affected plugin. Exploitation requires no user interaction and no authentication.

Critical Impact
Unauthenticated remote attackers can tamper with Event Aggregator import records and inject arbitrary content into hidden comment records on affected WordPress installations.

Affected Products

The Events Calendar WordPress plugin versions before 6.16.5.1
WordPress sites running Event Aggregator import functionality
Any hosted WordPress environment with the vulnerable plugin installed

Discovery Timeline

2026-07-27 - CVE-2026-13390 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-13390

Vulnerability Analysis

The vulnerability resides in an Event Aggregator import REST API route exposed by The Events Calendar plugin. The route omits a permission callback or capability check, so requests are accepted regardless of the caller's authentication state. A secondary defect allows a specific status value to bypass an integrity check that the plugin normally applies to import status transitions.

Attackers reach the vulnerable endpoint over the network using standard HTTP requests. By supplying an existing import identifier, an attacker can transition that record to a failed state. The same request path lets an attacker persist arbitrary content into a hidden comment record associated with the import.

The impact is limited to data integrity. The vulnerability does not expose confidential data and does not disrupt site availability, as reflected in the CVSS integrity-only impact profile.

Root Cause

The root cause is missing authorization [CWE-862] on a REST route registered by the plugin, compounded by an incomplete integrity check for one status value. The plugin registers the route without a permission_callback that validates the caller, and the status-handling logic accepts the crafted value without verifying the associated signature or nonce.

Attack Vector

Exploitation is network-based and requires no privileges or user interaction. An attacker sends an HTTP request to the vulnerable REST route on a target WordPress site running a version of The Events Calendar before 6.16.5.1. See the WPScan Vulnerability Details for the specific request pattern and endpoint identifier.

Detection Methods for CVE-2026-13390

Indicators of Compromise

Unexpected transitions of Event Aggregator import records to a failed status without administrator action
Presence of hidden WordPress comment records containing unusual or attacker-controlled content tied to import IDs
Anonymous REST API requests targeting Event Aggregator import routes in web server access logs

Detection Strategies

Query the WordPress database for wp_comments entries linked to Event Aggregator imports and review any records with non-standard comment types or content
Correlate REST API access logs against authenticated session events to identify unauthenticated calls reaching /wp-json/ routes exposed by The Events Calendar
Alert on high-frequency POST or GET requests to Event Aggregator endpoints from single source IP addresses

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and forward logs to a centralized analytics platform for retention and search
Monitor the installed plugin inventory across WordPress fleets and flag any host running The Events Calendar below version 6.16.5.1
Track outbound and inbound HTTP traffic patterns to WordPress sites, focusing on anomalous request bursts to /wp-json/tribe/ paths

How to Mitigate CVE-2026-13390

Immediate Actions Required

Update The Events Calendar plugin to version 6.16.5.1 or later on every WordPress site in the environment
Audit Event Aggregator import records and hidden comment records for tampering that occurred before patching
Restrict access to the WordPress REST API at the web server or WAF layer where feasible

Patch Information

The vendor released version 6.16.5.1 of The Events Calendar plugin, which adds the missing authorization check on the affected Event Aggregator import REST API route and reinstates the integrity check for the previously skipped status value. Site owners should apply this update through the WordPress plugin manager or WP-CLI. Reference the WPScan Vulnerability Details for advisory-level information.

Workarounds

Temporarily disable The Events Calendar plugin until the patched version is installed
Block unauthenticated requests to Event Aggregator REST routes using a web application firewall rule
Restrict the WordPress REST API to authenticated users through a security plugin or custom rest_authentication_errors filter

bash

# Update The Events Calendar to the patched release using WP-CLI
wp plugin update the-events-calendar --version=6.16.5.1
wp plugin list --name=the-events-calendar --fields=name,status,version