PT-2026-22024 · WordPress · The Events Calendar

Sdokus · Published 2026-02-25 · Updated 2026-02-26 · CVE-2026-2694

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions The Events Calendar plugin for WordPress versions prior to 6.15.16

Description The Events Calendar plugin for WordPress is susceptible to unauthorized modification and potential loss of data. This is due to an insufficient capability check within the can edit and can delete functions. Authenticated attackers possessing Contributor-level access or higher can leverage the REST API to modify or delete events, organizers, and venues. The affected API allows modification via the REST API. The vulnerable parameters include event data, organizer data, and venue data.

Recommendations Update The Events Calendar plugin to version 6.15.16 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-2694

Affected Products

The Events Calendar

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-2694 · Security Note
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.16/src/Tribe/REST/V1/Endpoints/Single_Venue.php#L583 · Note
• https://plugins.trac.wordpress.org/changeset/3468694/the-events-calendar · Note
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.16/src/Tribe/REST/V1/Endpoints/Single_Event.php#L498 · Note
• https://twitter.com/VulmonFeeds/status/2026832199434011042 · Twitter Post
• https://twitter.com/CVEnew/status/2027099265676537884 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/67351a37-a457-48d6-b40a-95a7e3a0d746?source=cve · Note
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.16/src/Tribe/REST/V1/Endpoints/Single_Event.php#L563 · Note
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.16/src/Tribe/REST/V1/Endpoints/Single_Venue.php#L529 · Note