PT-2026-22024 · WordPress · The Events Calendar

Sdokus · Publicado 2026-02-25 · Atualizado 2026-02-26 · CVE-2026-2694

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions The Events Calendar plugin for WordPress versions prior to 6.15.16

Description The Events Calendar plugin for WordPress is susceptible to unauthorized modification and potential loss of data. This is due to an insufficient capability check within the can edit and can delete functions. Authenticated attackers possessing Contributor-level access or higher can leverage the REST API to modify or delete events, organizers, and venues. The affected API allows modification via the REST API. The vulnerable parameters include event data, organizer data, and venue data.

Recommendations Update The Events Calendar plugin to version 6.15.16 or later.

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2026-2694

Produtos afetados

The Events Calendar

Referências · 9

• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.16/src/Tribe/REST/V1/Endpoints/Single_Venue.php#L583 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2694 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/3468694/the-events-calendar · Nota
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.16/src/Tribe/REST/V1/Endpoints/Single_Event.php#L498 · Nota
• https://twitter.com/VulmonFeeds/status/2026832199434011042 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2027099265676537884 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/67351a37-a457-48d6-b40a-95a7e3a0d746?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.16/src/Tribe/REST/V1/Endpoints/Single_Event.php#L563 · Nota
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.16/src/Tribe/REST/V1/Endpoints/Single_Venue.php#L529 · Nota