CVE-2026-84743: Events Calendar WordPress Privilege Escalation

CVE-2026-84743 Overview

CVE-2026-84743 is a broken access control vulnerability in The Events Calendar WordPress plugin before version 6.17.5. The plugin fails to perform a per-object capability check on one family of its REST API write routes. Authenticated users with a low-privilege role such as contributor can modify, unpublish, trash, and take ownership of records belonging to other users, including administrators. The flaw is categorized as [CWE-863] Incorrect Authorization.

Critical Impact
Low-privilege authenticated users can manipulate and reassign ownership of event records created by higher-privileged accounts, including administrators.

Affected Products

The Events Calendar WordPress plugin versions prior to 6.17.5
WordPress sites exposing the plugin's REST API write routes
Multi-author WordPress installations using contributor-level or higher roles

Discovery Timeline

2026-09-23 - CVE-2026-84743 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-84743

Vulnerability Analysis

The vulnerability resides in a family of REST API write routes exposed by The Events Calendar plugin. These endpoints authenticate the caller but do not enforce a per-object capability check before allowing writes. As a result, the authorization layer verifies that the user has a general capability to interact with the endpoint but never validates whether the user owns or has rights to the specific record being modified.

A contributor-level account can invoke these routes against records owned by any other user. The plugin then processes the write operation as if the caller had legitimate ownership. Actions include modifying event content, unpublishing published events, moving records to trash, and reassigning ownership to the calling user.

This flaw undermines the WordPress role and capability model. Site administrators expect contributor accounts to only affect their own draft content, yet this vulnerability collapses that boundary for the affected REST routes.

Root Cause

The root cause is a missing per-object authorization check in the REST controller's permission_callback or equivalent authorization function. The code verifies role membership but omits verification that the authenticated user owns, or has explicit rights to modify, the target record identified in the request.

Attack Vector

Exploitation requires an authenticated session with at least contributor-level access to the WordPress site. The attacker sends crafted HTTP requests to the vulnerable REST write routes referencing the identifier of a record owned by another user. The plugin processes the request without validating ownership. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-84743

Indicators of Compromise

Unexpected changes in event ownership fields, particularly records reassigned from administrator or editor accounts to contributor accounts
Events transitioning to trash or draft status without a corresponding action from the original owner
REST API access logs showing contributor accounts issuing POST, PUT, or DELETE requests against The Events Calendar endpoints referencing records they did not create

Detection Strategies

Audit the WordPress wp_posts table for events where the post_author field has changed and correlate against user activity logs
Compare the current owner of event records against historical backups to identify unauthorized ownership transfers
Enable REST API request logging and flag write operations from low-privilege roles targeting records owned by higher-privilege users

Monitoring Recommendations

Monitor web server access logs for requests to /wp-json/tribe/ REST namespaces originating from contributor-level sessions
Alert on high-volume REST write requests from a single authenticated user against multiple distinct event identifiers
Track WordPress audit log events for post_updated, post_trashed, and author change events on tribe_events post types

How to Mitigate CVE-2026-84743

Immediate Actions Required

Update The Events Calendar plugin to version 6.17.5 or later on all WordPress installations
Review recent event modifications and ownership changes to identify any records manipulated prior to patching
Audit user accounts with contributor role or higher and revoke access for accounts that are not required

Patch Information

The Events Calendar version 6.17.5 addresses the vulnerability by adding per-object capability checks to the affected REST write routes. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI. Reference the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily restrict contributor and author role assignments until the patch is applied
Block external access to /wp-json/tribe/ REST endpoints at the web application firewall for unauthenticated and low-privilege users
Disable the REST API for contributor-level accounts using a capability management plugin if patching is delayed

bash

# Update The Events Calendar plugin using WP-CLI
wp plugin update the-events-calendar --version=6.17.5

# Verify the installed version
wp plugin get the-events-calendar --field=version