Description

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-23T06:17:03.383Z",
  "pubdate": "2026-09-23T06:17:03.383Z",
  "executiveSummary": "The Events Calendar WordPress plugin contains an information disclosure vulnerability stemming from improper access control in its REST API implementation.\nThis vulnerability is classified as an authorization flaw where the application fails to validate the post status of linked records before returning them in API responses.\nThe vulnerability affects all versions of The Events Calendar prior to 6.17.5.\nThe primary impact is the unauthorized exposure of private, draft, or pending content that was intended to remain restricted to authorized users.\nSuccessful exploitation allows unauthenticated attackers to query the REST API and retrieve sensitive data embedded within these non-public records.\nThis poses significant privacy and data leakage risks for site administrators who may rely on post status as a primary security mechanism for draft content.\nNo specific privileges are required to exploit this vulnerability, as the affected endpoints are accessible to unauthenticated remote users over the network.\nThe flaw highlights a critical failure in enforcing the Principle of Least Privilege within custom REST API endpoints, allowing information retrieval outside of intended access control boundaries.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of data retrieval within the REST API controller logic for The Events Calendar plugin. Specifically, the API handlers responsible for returning linked records or related post data do not perform a 'post status' verification check (e.g., verifying if the object is 'publish') prior to serializing the data into the JSON response.\nIn the WordPress ecosystem, retrieving a post object typically requires an authorization check against the post's status. However, the affected components in the plugin bypass this inherent security check when aggregating related records. Consequently, even if a linked post is in a 'draft', 'pending', or 'private' state, the REST API response includes the full content of these records.\nThe attack flow begins with an unauthenticated attacker identifying the specific REST API endpoint provided by The Events Calendar that handles linked records. By crafting a GET request to this endpoint—often involving parameter manipulation to point to specific post IDs—the attacker triggers the vulnerable function.\nUpon receiving the request, the plugin fetches the linked record from the database. Due to the lack of status validation, the application proceeds to include sensitive fields (such as post content, excerpts, and metadata) in the REST API payload regardless of the object's visibility status.\nBecause this information is returned via a public REST API interface, it requires no prior authentication or administrative privileges. An attacker can systematically enumerate post IDs or observe API responses to scrape content that is explicitly marked as non-public by the site owner.\nThis vulnerability is particularly impactful because it allows for the discovery of future event content, draft marketing materials, or internal site communications that were never intended to be exposed. The exposure occurs over standard HTTP/HTTPS protocols, making it trivial for an attacker to execute via standard web browser requests or automated tools like curl or Burp Suite. There is no complex payload required; the exploit relies solely on the application's failure to respect the post status lifecycle during the data fetching process."
}