WordPress · The Events Calendar · CVE-2023-6557
**Name of the Vulnerable Software and Affected Versions**
The Events Calendar plugin for WordPress versions up to, and including, 6.2.8.2
**Description**
The issue allows unauthenticated attackers to extract potentially sensitive data, including post titles and IDs of pending, private, and draft posts, via the route function hooked into `wp ajax nopriv tribe dropdown`. This enables the exposure of sensitive information.
**Recommendations**
For versions up to, and including, 6.2.8.2, update to a version later than 6.2.8.2 to resolve the issue. As a temporary workaround, consider restricting access to the `wp ajax nopriv tribe dropdown` route function until a patch is available.