CyberRota Analysis
AI-GeneratedThe Events Calendar plugin for WordPress prior to version 6.17.5 is vulnerable as it fails to verify user capabilities when publishing content via its REST API. This flaw allows users with restricted roles, like contributors, to publish content directly, circumventing the intended editorial review process. WordPress site administrators and those managing user roles should prioritize this vulnerability to prevent unauthorized content publication.
CVE
CVE-2026-84742
Severity
LOW
CVSS
2.7
EPSS
0.23%
WordPress
Original NVD Description
The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.