rootpwn

medium · CVSS v3 3.8 · EPSS 0.0018

CVE-2026-84743

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its R…

Description

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.

Scores

Severity
medium
CVSS v2
4.7
CVSS v3
3.8
CVSS v4
—
EPSS
0.0018

← All CVEs

Related CVEs

medium

CVE-2026-84741

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.

View analysis

medium

CVE-2026-86602

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.

View analysis

medium

CVE-2026-86603

WP Recipe Maker plugin versions prior to 10.8.2 lack an authorization check on an AJAX endpoint, enabling any logged-in user to view unpublished recipe list IDs and titles. This flaw can expose sensitive content and user data. It affects sites running the vulnerable plugin.

View analysis

medium

CVE-2026-86601

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.

View analysis