CVE-2026-84745: Events Calendar WordPress Information Disclosure

CVE-2026-84745 Overview

CVE-2026-84745 is an information disclosure vulnerability in The Events Calendar WordPress plugin versions before 6.17.3.1. The plugin fails to restrict non-public content on its public REST archives to users entitled to view it. Authenticated users with a low-privilege role such as contributor can read the full contents of every unpublished record on the site, including drafts authored by other users. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
A contributor-level account can enumerate and read all unpublished event records site-wide, exposing draft content authored by other users through the plugin's REST API archives.

Affected Products

The Events Calendar WordPress plugin versions prior to 6.17.3.1
WordPress sites permitting contributor or higher role registration
Multi-author WordPress deployments using The Events Calendar for private or unpublished event workflows

Discovery Timeline

2026-09-05 - CVE-2026-84745 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84745

Vulnerability Analysis

The Events Calendar plugin exposes REST API archive endpoints to serve event content to public consumers. The archive endpoints return post objects without validating whether the requesting user is entitled to view non-public post statuses such as draft, pending, or private. Any authenticated user, including those holding the lowest-privilege authoring role, can iterate the archive and retrieve records they should not be able to see.

This is a broken access control failure at the REST layer. The plugin conflates "published on the public site" with "readable through the public REST archive," and treats archive queries as a public data feed regardless of the underlying post status. Draft events belonging to other authors, along with any metadata serialized into the REST response, are returned in full.

Root Cause

The root cause is missing authorization enforcement on the REST archive controller. The plugin's query layer does not scope results by post status against the caller's capabilities. A properly gated implementation would exclude non-publish statuses from public archive responses or verify the caller holds read_private_posts or ownership before returning a given record.

Attack Vector

Exploitation requires an authenticated session at the contributor role or higher. The attacker issues standard HTTP GET requests to the plugin's public REST archive endpoints and parses the returned JSON for records with non-public statuses. No special tooling, chaining, or user interaction is required. The attack is network-reachable wherever the WordPress REST API is exposed.

See the WPScan Vulnerability Report for the technical write-up.

Detection Methods for CVE-2026-84745

Indicators of Compromise

Unexpected HTTP GET requests from low-privilege authenticated sessions to The Events Calendar REST archive routes under /wp-json/.
Elevated request volume from a single contributor account enumerating paginated archive results.
REST responses returning event records whose status field is draft, pending, or private to non-privileged sessions.

Detection Strategies

Review web server and WordPress access logs for authenticated requests to The Events Calendar REST endpoints paired with pagination parameters such as page or per_page.
Correlate contributor-role session cookies with REST API calls that return non-published post objects.
Compare plugin version reported by the site against the fixed release 6.17.3.1 to identify vulnerable installations.

Monitoring Recommendations

Enable WordPress REST API request logging and forward it to a centralized log store for retention and query.
Alert on any authenticated REST response containing post status values other than publish from public archive routes.
Track new contributor account registrations and correlate them with subsequent REST API activity within a short window.

How to Mitigate CVE-2026-84745

Immediate Actions Required

Upgrade The Events Calendar plugin to version 6.17.3.1 or later on all WordPress installations.
Audit existing contributor and equivalent low-privilege accounts and remove any that are unused or unrecognized.
Review draft, pending, and private event records for sensitive content that may have been exposed prior to patching.

Patch Information

The vendor addressed the issue in The Events Calendar version 6.17.3.1. The fix restricts REST archive responses so that non-public post statuses are not returned to users without the required capability. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily disable The Events Calendar plugin until the patched version can be deployed.
Restrict access to the WordPress REST API for authenticated low-privilege roles via a security plugin or web application firewall rule.
Close open user registration and require administrator approval for new accounts to reduce the pool of eligible attackers.

bash

# Example WP-CLI upgrade command
wp plugin update the-events-calendar --version=6.17.3.1
wp plugin get the-events-calendar --field=version