The Events Calendar <= 6.17.5 - Authenticated (Contributor+) Missing Authorization to Event, Venue and Organizer Author Assignment via REST API
- ID
- WPSEC-2026-0235
- Plugin
- The Events Calendar (the-events-calendar)
- Affected
- from 4.6 before 6.17.5.1
- Remediation
- Update to 6.17.5.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- The Events Calendar on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-97285, on 2026-09-30.
Description
The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the author field of its REST API create and update endpoints in all versions up to, and including, 6.17.5. The tribe/events/v1 event, venue and organizer endpoints pass the user-supplied 'author' value directly into the post author, and the tec/v1 entity endpoints accept it unchanged, without checking the post type's edit_others_posts capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to attribute events, venues and organizers they create or edit to any other user, including administrators.
References
- https://wpsec.com/vuln/WPSEC-2026-0235/
- https://plugins.svn.wordpress.org/the-events-calendar/tags/6.17.5.1/
- https://wordpress.org/plugins/the-events-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS