CyberRota Analysis
AI-GeneratedThe Events Calendar plugin for WordPress prior to version 6.17.5 is vulnerable due to inadequate capability checks on certain REST write routes, enabling low-privilege users, like contributors, to modify and manage records belonging to other users, including administrators. This could lead to unauthorized changes and potential data manipulation within the application. WordPress site administrators and security teams should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.