CVE-2026-84745— The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
Quick assessment
Affected
Unknown The Events Calendar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Events Calendar 插件在 6.17.3.1 版本之前，未将其公开的 REST API 归档中的非公开内容限制为仅授权用户可读取，这使得拥有较低权限角色（如 contributor）的用户能够读取站点上所有未发布记录的完整内容，包括其他用户的记录。
Possible ATT&CK Techniques 2 AI
T1572 · Protocol Tunneling T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | The Events Calendar | < 6.17.3.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84745
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
Source: CVE Program / CVE List V5
Vulnerability Description
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | The Events Calendar | 0 ~ 6.17.3.1 | - |
|
II. Public POCs for CVE-2026-84745
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84745
请登录查看更多情报信息。
Other References for CVE-2026-84745 (1)
-
🔗 The Events Calendar < 6.17.3.1 – Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API | CVE 2026-84745 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-05 · 34 CVEs total
| CVE-2026-77826 | RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Fa | |
| CVE-2026-82304 | Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler | |
| CVE-2026-81424 | Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR | |
| CVE-2026-83543 | Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint | |
| CVE-2026-83544 | Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute | |
| CVE-2026-81423 | Accept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler | |
| CVE-2026-81348 | My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and | |
| CVE-2026-81404 | IPGP Visitors Origin < 1.6 - Reflected XSS | |
| CVE-2026-78362 | SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Au | |
| CVE-2026-82846 | Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields | |
| CVE-2026-78149 | Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post_pas | |
| CVE-2026-78150 | Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure v | |
| CVE-2026-19861 | JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Em | |
| CVE-2026-15247 | Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deleti | |
| CVE-2026-19858 | JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure | |
| CVE-2025-15694 | Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS | |
| CVE-2025-15693 | JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal | |
| CVE-2026-84937 | YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax | |
| CVE-2026-84021 | Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_ | |
| CVE-2026-84022 | Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attribu |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: The Events Calendar
-
CVE-2026-78159
The Events Calendar <= 6.17.3 - Unauthenticated Code Injecti -
CVE-2026-78006
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object I -
CVE-2026-78265
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object -
CVE-2026-13390
The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggre -
CVE-2026-49772
WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL In
Same vendor: Unknown
-
CVE-2026-87919
Product XML Feed Manager for WooCommerce < 3.1.1 - Contribut -
CVE-2026-87918
WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Mu -
CVE-2026-87892
Rox Appointment Booking < 1.2.0 - Unauthenticated Price Mani -
CVE-2026-87894
Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Cust -
CVE-2026-87891
Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Sc
V. Comments for CVE-2026-84745
No comments yet