CVE-2026-84742: Events Calendar WordPress Auth Bypass Flaw

CVE-2026-84742 Overview

CVE-2026-84742 is an authorization flaw in The Events Calendar plugin for WordPress affecting versions prior to 6.17.5. The plugin fails to verify user capabilities before creating or updating content through its REST API endpoints. Contributors and other low-privileged users can publish content directly, bypassing editorial review workflows. The weakness maps to [CWE-863: Incorrect Authorization]. Exploitation requires an authenticated account with at least contributor-level access on the target WordPress site.

Critical Impact
Authenticated low-privileged users can bypass editorial review and publish content through The Events Calendar REST API without the capability checks normally required by WordPress.

Affected Products

The Events Calendar WordPress plugin versions before 6.17.5
WordPress sites permitting contributor or higher-role registration
Multi-author WordPress deployments relying on editorial review workflows

Discovery Timeline

2026-09-23 - CVE-2026-84742 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-84742

Vulnerability Analysis

The Events Calendar plugin exposes REST API endpoints for managing event content. These endpoints handle create and update operations for events and related objects. The plugin does not validate whether the calling user holds the publish_posts capability before persisting content in a published state.

WordPress role-based access control distributes capabilities across roles such as subscriber, contributor, author, editor, and administrator. Contributors can author drafts but cannot publish them without editor review. The plugin's REST handlers accept publish requests from any authenticated user with baseline access to the endpoint, effectively collapsing the role separation for event content.

The result is a business logic and authorization gap. Content that should require editorial approval reaches the live site without moderation. The impact is limited to integrity of published content, with no direct effect on confidentiality or availability.

Root Cause

The root cause is a missing capability check in the REST API permission callback. The plugin's permission_callback grants access based on authentication and endpoint-level rights rather than validating the specific publish_posts or equivalent capability tied to the requested action. This is a classic [CWE-863] pattern where an authorization decision is made against the wrong criteria.

Attack Vector

An attacker first obtains a contributor-level account, either through open registration or by compromising an existing low-privileged user. The attacker then sends an authenticated REST API request to the vulnerable event creation or update endpoint with a published status. The plugin processes the request without verifying publishing capability and stores the content live. See the WPScan Vulnerability Report for endpoint specifics.

No verified exploit code is publicly available. The vulnerability mechanism is described in the vendor advisory rather than reproduced here.

Detection Methods for CVE-2026-84742

Indicators of Compromise

Event posts appearing in a published state authored by users whose role lacks the publish_posts capability
REST API requests to Events Calendar endpoints containing status=publish originating from contributor accounts
Unexpected published events with timestamps that do not match any editorial workflow entry in site logs
New or dormant contributor accounts generating write activity against /wp-json/tribe/ routes

Detection Strategies

Review WordPress audit logs for post transitions from draft to publish performed by non-editor roles
Correlate web server access logs for POST and PUT requests to Events Calendar REST endpoints with the authenticated user role at the time of the request
Query the wp_posts table for events where post_status = 'publish' and post_author corresponds to a contributor role account

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture REST API calls with user, endpoint, and payload metadata
Alert on REST calls to Events Calendar routes by users below editor level
Track newly registered accounts that immediately interact with content publishing endpoints

How to Mitigate CVE-2026-84742

Immediate Actions Required

Upgrade The Events Calendar plugin to version 6.17.5 or later on all WordPress sites
Audit existing published events for content created by contributor-level accounts and unpublish unauthorized entries
Review contributor and subscriber account inventories and disable accounts that show no legitimate activity

Patch Information

The vendor addressed the flaw in The Events Calendar version 6.17.5 by adding the required capability check to the affected REST API permission callbacks. Refer to the WPScan Vulnerability Report for advisory details and confirm the fixed version through the WordPress plugin repository before deploying.

Workarounds

Temporarily restrict registration to trusted users and set the default new user role to subscriber until patching completes
Block anonymous access to /wp-json/tribe/ REST routes at the web application firewall until the plugin is updated
Require an editor or administrator to review the events queue daily until the patched version is confirmed in production

bash

# Configuration example
# Restrict Events Calendar REST endpoints via .htaccess until patching
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} ^/wp-json/tribe/ [NC]
  RewriteCond %{HTTP:Authorization} ^$
  RewriteRule .* - [F,L]
</IfModule>