CVE-2026-13390 is a missing authorization vulnerability (CWE-862) in The Events Calendar WordPress plugin prior to version 6.16.5.1. The vulnerability exists because the plugin does not perform an authorization check on a specific Event Aggregator import REST API route and skips an integrity check for a particular status value. This allows unauthenticated attackers to manipulate import records by marking them as failed and injecting arbitrary content into hidden comment records. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the lack of confidentiality or availability impact but the presence of integrity impact.

An unauthenticated attacker can exploit this vulnerability to alter the status of import records and inject arbitrary content into hidden comment records. This compromises the integrity of the import data but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects versions before 6.16.5.1, so upgrading to version 6.16.5.1 or later is expected to address the issue once an official fix is released. Until then, restrict access to the affected REST API routes if possible.