CVE-2026-97285— WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability
Quick assessment
Affected
Nexcess The Events Calendar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
The Events Calendar 插件在 6.17.5 及更早版本中存在贡献者（Contributor）角色的访问控制失效漏洞。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97285
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Nexcess | The Events Calendar | n/a ~ 6.17.5 | - |
|
II. Public POCs for CVE-2026-97285
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97285
请登录查看更多情报信息。
Other References for CVE-2026-97285 (1)
Same Patch Batch · Nexcess · 2026-09-30 · 7 CVEs total
| CVE-2026-97287 | 8.5 HIGH | WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability |
| CVE-2026-94677 | 7.2 HIGH | WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vul |
| CVE-2026-96830 | 7.1 HIGH | WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-96834 | 6.5 MEDIUM | WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability |
| CVE-2026-97266 | 6.5 MEDIUM | WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) v |
| CVE-2026-97066 | 5.3 MEDIUM | WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability |
IV. Related Vulnerabilities
Same product: The Events Calendar
-
CVE-2026-84743
The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Even -
CVE-2026-84742
The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content -
CVE-2026-84741
The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Pub -
CVE-2026-78159
The Events Calendar <= 6.17.3 - Unauthenticated Code Injecti -
CVE-2026-78006
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object I
Same vendor: Nexcess
-
CVE-2026-97287
WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vul -
CVE-2026-97266
WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 -
CVE-2026-97066
WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object R -
CVE-2026-96834
WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure -
CVE-2026-96830
WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XS
Same weakness: CWE-862
-
CVE-2026-97267
WordPress Prevent files / folders access plugin <= 2.6.7 - B -
CVE-2026-97247
WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access -
CVE-2026-97243
WordPress AllAble Connector plugin <= 0.13.4 - Broken Access -
CVE-2026-97239
WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken -
CVE-2026-97197
WordPress WordPress Backup & Migration plugin <= 1.6.0 - Bro
V. Comments for CVE-2026-97285
No comments yet