CVE-2026-84742

LOWCVSS 2.7

Description

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.

Timeline

Published:September 23rd, 2026 6:17 AM

Last modified:September 23rd, 2026 6:13 PM

CVSS Scoring

CVSS v3: 2.7 (LOW)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-863

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/f9228a51-1293-4a96-95da-0e57b7eb5f6b/

Source: NIST NVD · Data may lag official sources by up to one minute