CVE-2026-84741: Events Calendar WordPress Info Disclosure

CVE-2026-84741 Overview

CVE-2026-84741 is an information disclosure vulnerability in The Events Calendar WordPress plugin versions prior to 6.17.5. The plugin fails to check the post status of linked records before embedding their stored details in a public REST API response. Unauthenticated remote attackers can query the affected REST endpoint and read the contents of records that were never published, including drafts and other non-public entries. The vulnerability is categorized under [CWE-200] Information Exposure.

Critical Impact
Unauthenticated network attackers can retrieve unpublished event data from any WordPress site running a vulnerable version of The Events Calendar plugin.

Affected Products

The Events Calendar WordPress plugin versions prior to 6.17.5
WordPress sites exposing the plugin's public REST API endpoints
Sites with unpublished, draft, or private event records

Discovery Timeline

2026-09-23 - CVE-2026-84741 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-84741

Vulnerability Analysis

The Events Calendar plugin exposes REST API endpoints that return event details along with references to linked records such as venues and organizers. The response builder embeds the stored details of these linked records directly into the API payload without validating whether the linked post is publicly available. As a result, records with post statuses such as draft, pending, private, or auto-draft are serialized into the response and returned to any caller.

The flaw affects confidentiality only. It does not permit modification of data or disruption of service. The absence of a post-status check occurs on a server-reachable endpoint that does not require authentication or user interaction, which broadens the exposure to any anonymous internet client. See the WPScan Vulnerability Report for technical details.

Root Cause

The root cause is missing authorization logic in the REST response construction path. When the plugin resolves linked record identifiers into their stored metadata, it retrieves the underlying post objects without filtering on post_status. WordPress core visibility rules that ordinarily hide non-published content are bypassed because the plugin performs the lookup at the database level and inlines the results.

Attack Vector

An unauthenticated attacker issues an HTTP GET request to the affected plugin REST endpoint. The response includes fields populated from linked records regardless of their publication state. No credentials, tokens, or user interaction are required. The technique can be scripted at scale against any exposed WordPress site to enumerate unpublished venue names, organizer contact details, event descriptions, and related metadata that site owners intended to keep private.

No public proof-of-concept code or exploit is currently available. Refer to the WPScan Vulnerability Report for further technical detail.

Detection Methods for CVE-2026-84741

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/tribe/events/ REST routes from unexpected sources or bulk scanners
Access log entries showing enumeration patterns against event, venue, or organizer REST endpoints
Elevated outbound response sizes from public REST endpoints correlated with anonymous clients

Detection Strategies

Review web server access logs for high-volume, unauthenticated requests to The Events Calendar REST endpoints
Compare REST API responses against the WordPress admin view of published records to identify leaked draft or private content
Deploy web application firewall rules that flag anonymous access to plugin REST routes returning post-linked metadata

Monitoring Recommendations

Enable request logging on WordPress REST API routes exposed by The Events Calendar plugin
Alert on repeated 200 OK responses to /wp-json/tribe/ paths from single client IPs or user agents associated with vulnerability scanners
Track plugin version inventory across managed WordPress sites and flag any instance below 6.17.5

How to Mitigate CVE-2026-84741

Immediate Actions Required

Upgrade The Events Calendar plugin to version 6.17.5 or later on all WordPress sites
Audit unpublished event, venue, and organizer records for sensitive data that may have been exposed while the vulnerable version was in use
Rotate or redact any confidential details stored in draft records if exposure is suspected

Patch Information

The vendor addressed the issue in The Events Calendar version 6.17.5 by adding a post-status check before embedding linked record details in REST API responses. Site administrators should update through the WordPress plugin manager or via WP-CLI. See the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Restrict access to /wp-json/tribe/ REST routes at the web server or WAF layer until the plugin is updated
Temporarily deactivate The Events Calendar plugin on sites that cannot immediately apply the patch
Remove sensitive information from unpublished records until the update is deployed

bash

# Update The Events Calendar plugin using WP-CLI
wp plugin update the-events-calendar --version=6.17.5

# Verify installed version
wp plugin get the-events-calendar --field=version