PT-2026-64838 · WordPress · The Events Calendar

Haitam Lazaar · CVE-2026-13390 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Events Calendar versions prior to 6.16.5.1

Description The plugin fails to perform an authorization check on an Event Aggregator import REST API route and bypasses an integrity check for a specific status value. This allows unauthenticated attackers to mark existing import records as failed and store arbitrary content within a hidden comment record.

Recommendations Update to version 6.16.5.1 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-13390

Affected Products

The Events Calendar

References · 3

• 🔥 https://wpscan.com/vulnerability/c7d3b1c5-3b3a-4359-aa41-0dfccb091fa4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-13390 · Security Note
• https://t.me/CVEtracker/61294 · Telegram Post